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Most of this handbook is devoted to techniques and 
information to help you design and implement semi- 
conductor memory in your application or system. In 
this section, however, the memory chip itself will be 
examined and the processing technology required to 
turn a bare slice of silicon into high performance 
memory devices is described. The discussion has 
been limited to the basics of MOS (Metal Oxide 
Semiconductor) technologies as they are responsi- 
ble for the majority of memory devices manufactured 
at Intel. 


There are three major MOS technology families— 
PMOS, NMOS, and CMOS (Figure 1). They refer to 
the channel type of the MOS transistors made with 
the technology. PMOS technologies implement 
p-channel transistors by diffusing p-type dopants 
(usually boron) into an n-type silicon substrate to 
form the source and drain. P-channel is so named 
because the channel is comprised of positively 
charged carriers. NMOS technologies are similar, 
but use n-type dopants (normally phosphorus or ar- 
senic) to make n-channel transistors in p-type silicon 
substrates. N-channel is so named because the 
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channel is comprised of negatively charged carriers. 
CMOS or Complementary MOS technologies com- 
bine both p-channel and n-channel devices on the 
same silicon. Either p- or n-type silicon substrates 
can be used, however, deep areas of the opposite 
doping type (called wells) must be defined to allow 
fabrication of the complementary transistor type. 


Most of the early semiconductor memory devices, 
like Intel’s pioneering 1103 dynamic RAM and 1702 
EPROM were made with PMOS technologies. As 
higher speeds and greater densities were needed, 
most new devices were implemented with NMOS. 
This was due to the inherently higher speed of 
n-channel charge carriers (electrons) in silicon along 
with improved process margins. CMOS technology 
has begun to see widespread commercial use in 
memory devices. It allows for very low power devic- 
es used for battery operated or battery back-up ap- 
plications. Historically, CMOS has been slower than 
any NMOS device. Today, CMOS technology has 
been improved to produce higher speed devices. 
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Figure 1. MOS Process Cross-sections 
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In the following section, the basic fabrication se- 
quence for an HMOS circuit will be described. 
HMOS is a high performance n-channel MOS pro- 
cess developed by Intel for 5V single supply circuits. 
HMOS, and CHMOS, CHMOS-E (EPROM) and 
ETOX (Flash Memory), along with their evolutionary 
counterparts comprise the process family responsi- 
ble for most of the memory components produced 
by Intel today. 


The MOS IC fabrication process begins with a slice 
(or wafer) of single crystal silicon. Typically, it’s 150 
or 200 millimeter in diameter, about a half millimeter 
thick, and uniformly doped p-type. The wafer is then 
oxidized in a furnace at around 1000°C to grow a 
thin layer of silicon dioxide (SiOz) on the surface. 
Silicon nitride is then deposited on the oxidized wa- 
fer in a gas phase chemical reactor. The wafer is 
now ready to receive the first pattern of what is to 
become a many layered complex circuit. The pattern 
is etched into the silicon nitride using a process 
known as photolithography, which will be described 
in a later section. This first pattern (Figure 2) defines 
the boundaries of the active regions of the IC, where 
transistors, capacitors, diffused resistors, and first 
level interconnects will be made. 
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Figure 2. First Mask 


The patterned and etched wafer is then implanted 
with additional boron atoms accelerated at high en- 
ergy. The boron will only reach the silicon substrate 
where the nitride and oxide was etched away, pro- 
viding areas doped strongly p-type that will electri- 
cally separate active areas. After implanting, the wa- 
fers are oxidized again and this time a thick oxide is 
grown. The oxide only grows in the etched areas 
due to silicon nitride’s properties as an oxidation bar- 
rier. When the oxide is grown, some of the silicon 
substrate is consumed and this gives a physical as 
well as electrical isolation for adjacent devices as 
can be seen in Figure 3. 
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Figure 3. Post Field Oxidation 
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Having fulfilled its purpose, the remaining silicon ni- 
tride layer is removed. A light oxide etch follows tak- 


ing with it the underlying first oxide but leaving the 
thick (field) oxide. 


Now that the areas for active transistors have been 
defined and isolated, the transistor types needed 
can be determined. The wafer is again patterned 
and then if special characteristics (such as depletion 
mode operation) are required, it is implanted with 
dopant atoms. The energy and dose at which the 
dopant atoms are implanted determines much of the 
transistor’s characteristics. The type of the dopant 
provides for depletion mode (n-type) or enhance- 
ment mode (p-type) operation. 


The transistor types defined, the gate oxide of the 
active transistors are grown in a high temperature 
furnace. Special care must be taken to prevent con- 
tamination or inclusion of defects in the oxide and to 
ensure uniform consistent thickness. This is impor- 
tant to provide precise, reliable device characteris- 
tics. The gate oxide layer is then masked and holes 
are etched to provide for direct gate to diffusion 
(“buried”) contacts where needed. 


The wafers are now deposited with a layer of gate 
material. This is typically poly crystaline silicon 
(“poly’’) which is deposited in a gas phase chemical 
reactor similar to that used for silicon nitride. The 
poly is then doped (usually with phosphorus) to bring 
the sheet resistance down to 10-20 /square. This 
layer is also used for circuit interconnects and if a 
lower resistance is required, a refractory metal/poly- 
silicon composite or refractory metal silicide can be 
used instead. The gate layer is then patterned to 
define the actual transistor gates and interconnect 
paths (Figure 4). 
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Figure 4. Post Gate Mask 


The wafer is next diffused with n-type dopant (typi- 
cally arsenic or phosphorus) to form the source and 
drain junctions. The transistor gate material acts as 
a barrier to the dopant providing an undiffused chan- 
nel self-aligned to the two junctions. The wafer is 
then oxidized to seal the junctions from contamina- 
tion with a layer of SiO» (Figure 5). 


ote POLYSILICON 
CONTACT OXIDE 


moo GATE 
eee, 1 
Gai OnE 


° 
"C101 nd 
[sees 


aera N+ Ne 
P+ P-SUBSTRATE 


296102-7 


Figure 5. Post Oxidation 


A thick layer glass is then deposited over the wafer 
to provide for insulation and sufficiently low capaci- 
tance between the underlying layers and the metal 
interconnect signals. (The lower the capacitance, 
the higher the inherent speed of the device.) The 
glass layer is then patterned with contact holes and 
placed in a high temperature furnace. This furnace 
step smooths the glass surface and rounds the con- 
tact edges to provide uniform metal coverage. Metal 
(usually aluminum or aluminum/silicon) is then de- 
posited on the wafer and the interconnect patterns 
and external bonding pads are defined and etched 
(Figure 6). The wafers then receive a low tempera- 
ture (approximately 500°C) alloy that insures good 
ohmic contact between the aluminum and diffusion 
or poly. 
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Figure 6. Complete Circuit (without passivation) 


At this point the circuit is fully operational, however, 
the top metal layer is very soft and easily damaged 
by handling. The device is also susceptible to con- 
tamination or attack from moisture. To prevent this 
the wafers are sealed with a passivation layer of sili- 
con nitride or a silicon and phosphorus oxide com- 
posite. Patterning is done for the last time opening 
up windows only over the bond pads where external 
connections will be made. 


This completes basic fabrication sequence for a sin- 
gle poly layer process. Double poly processes such 
as those used for high density Dynamic RAMs, 
EPROMs, flash memories, and EEPROMs follow the 
same general process flow with the addition of gate, 
poly deposition, doping, and interlayer dielectric pro- 
cess modules required for the additional poly layer 
(Figure 7). These steps are performed right after the 
active areas have been defined (Figure 3) providing 
the capacitor or floating gate storage nodes on 
those devices. 
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Figure 7. Double Poly Structure 


After fabrication is complete, the wafers are sent for 
testing. Each circuit is tested individually under con- 
ditions designed to determine which circuits will op- 
erate properly both at low temperature and at condi- 
tions found in actual operation. Circuits that fail 
these tests are noted to distinguish them from good 
circuits. From here the wafers are sent for assembly 
where they are sawed into individual circuits with a 
paper-thin diamond blade. The noted circuits are 
then separated out and the good circuits are sent on 
for packaging. 


Packages fall into two categories—hermetic and 
non-hermetic. Hermetic packages are Cerdip, where 
two ceramic halves are sealed with a glass fritt, or 
ceramic with soldered metal lids. An example of her- 
metic package assembly is shown in Table 1. Non- 
hermetic packages are molded plastics. 


The ceramic package has two parts, the base, which 
has the leads and die (or circuit) cavity, and the met- 
al lid. The base is placed on a heater block and a 
metal alloy preform is inserted. The die is placed on 
top of the preform which bonds it to the package. 
Once attached, wires are bonded to the circuit and 
then connected to the leads. Finally the package is 
placed in a dry inert atmosphere and the lid is sol- 
dered on. 


The cerdip package consists of a base, lead frame, 
and lid. The base is placed on a heater block and 
the lead frame placed on top. This sets the lead 
frame in glass attached to the base. The die is then 
attached and bonded to the leads. Finally the lid is 
placed on the package and it is inserted in a seal 
furnace where the glass on the two halves melt to- 
gether making a hermetic package. 


In a plastic package, the key component is the lead 
frame. The die is attached to a pad on the lead 
frame and bonded out to the leads with gold wires. 
The frame then goes to an injection molding ma- 
chine and the package is formed around the lead 
frame. After mold the excess plastic is removed and 
the leads trimmed. 
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After assembly, the individual circuits are retested at 
an elevated operating temperature to assure critical 
operating parameters and separated according to 
speed and power consumption into individual speci- 
fication groups. The finished circuits are marked and 
then readied for shipment. 


‘The basic process flow described above may make 
VLSI device fabrication sound straightforward, how- 
ever, there are actually hundreds of individual opera- 
tions that must be performed correctly to complete a 
working circuit. It usually takes well over two months 
to complete all these operations and the many tests 
and measurements involved throughout the manu- 
facturing process. Many of these details are respon- 
sible for ensuring the performance, quality, and reli- 
ability you expect from Intel products. The following 
sections will discuss the technology underlying each 
of the major process elements mentioned in the ba- 
sic process flow. 


PHOTOLITHOGRAPHY 


The photo or masking technology is the most impor- 
tant part of the manufacturing flow if for no other 
reason than the number of times it is applied to each 
wafer. The manufacturing process gets more com- 
plex in order to make smaller and higher perform- 
ance circuits. As this happens the number of mask- 
ing steps increases, the features get smaller, and 
the tolerance required becomes tighter. This is 
largely because the minimum size of individual pat- 
tern elements determine the size of the whole cir- 
cuit, effecting its cost and limiting its potential com- 
plexity. Early MOS IC’s used minimum geometries 
(lines or spaces) of 8-10 microns (1 micron = 10-6 
meter = 1/25,000 inch). The n-channel processes 
of the mid 1970’s brought this down to approximate- 
ly 5 microns, and today minimum geometries of 0.8 
and even 0.6 microns are in production. This dra- 


Table 1. Typical Hermetic Package Assembly 


Wafer 

Die saw, wafer break 
Die wash and plate 
Die visual inspection 
QA gate 


Die attach 
(Process monitor) 


Post die attach visual 


Wire bond 
(Process monitor) 


Post bond inspection 
QA gate 


Seal and Mark 
(Process monitor) 


Temp cycle 


Hermeticity check 
(Process monitor) 


Lead Trim 


Passivation, metal 


Wet out 


Orientation, lead 
dressing, etc. 


All previous items 


Cap align, glass 
integrity, moisture 


F/G leak 


100% of die 
Every lot 
4 x /operator/shift 


0/76, LTPD =5% 
0/11 LTPD = 20% 


100% of devices 


4 x /operator/ 
machine/shift 


100% devices 
every lot 
4x /furnace/shift 


1/129, LTPD = 3% 
0/15, LTPD = 15% 


10x to mil std. 
883 cond. C 


100% devices 


1/11, LTPD = 20% 


(Process monitor) 
External visual 


QA gate 


Class test 
(Process monitor) 


Mark and Pack 
Final QA 


Burrs, etc. (visual) 
Fine leak 


Solder voids, cap 
alignment, etc. 


All previous items 


Run standards 
(good and reject) 
Calibrate every 
system using 
“autover’’ program 


(See attached) 


4 x/station/shift 
2 x/station/shift 


100% devices 


All lots 
Every 48 hrs. 


0/15, LTPD = 15% 
1/129, LTPD = 3% 


1/129, LTPD =3% 
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NOTES: 
1. Units for assembly reliability monitor. 
2. Units for product reliability monitor. 
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matic reduction in feature size was achieved using 
the newer high resolution photo resists and optimiz- 
ing their processing to match improved optical print- 
ing systems. 


A second major factor in determining the size of the 
circuit is the registration or overlay error. This is how 
accurately one pattern can be aligned to a previous 
one. Design rules require that space be left in all 
directions according to the overlay error so that un- 
related patterns do not overlap or interfere with one 
another. As the error space increases the circuit size 
increases dramatically. Only a few years ago stan- 
dard alignment tolerances were = +2 microns; now 
advanced Intel processes have reduced this dramat- 
ically due mostly to the use of advanced projection 
and step and repeat exposure equipment. 


The wafer that is ready for patterning must go 
through many individual steps before that pattern is 
complete. First the wafer is baked to remove mois- 
ture from its surface and is then treated with chemi- 
cals that ensure good resist adhesion. The thick 
photoresist liquid is then applied and the wafer is 
spun flat to give a uniform coating, critical for high 
resolution. The wafer is baked at a low temperature 
to solidify the resist into gel. It is then exposed with a 
machine that aligns a mask with the new pattern on 
it to a previously defined layer. The photo-resist will 
replicate this pattern on the wafer. 


Negative working resists are polymerized by the light 
and the unexposed resist can be rinsed off with sol- 
vents. Positive working resists use photosensitive 
polymerization inhibitors that allow a chemically re- 
active developer to remove the exposed areas. The 
positive resists require much tighter control of expo- 
sure and development but yield higher resolution 
patterns than negative resistance systems. 


The wafer is now ready to have its pattern etched. 
The etch procedure is specialized for each layer to 
be etched. Wet chemical etchants such as hydro- 
fluoric acid for silicon oxide or phosphoric acid for 
aluminum are often used for this. The need for 
smaller features and tighter control of etched dimen- 
sions is increasing the use of plasma etching in fab- 
rication. Here a reactor is run with a partial vacuum 
into which etchant gases are introduced and an 
electrical field is applied. This yields a reactive plas- 
ma which etches the required layer. 


The wafer is now ready for the next process step. Its 
single journey through the masking process required 
the careful engineering of mechanics, optics, organ- 
ic chemistry, inorganic chemistry, plasma chemistry, 
physics, and electronics. 
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DIFFUSION 


The picture of clean room garbed operators tending 
furnace tubes glowing cherry red is the one most 
often associated with IC fabrication. These furnace 
operations are referred to collectively as diffusion 
because they employ the principle of sold state diffu- 
sion of matter to accomplish their results. In MOS 
processing, there are three main types of diffusion 
operations: predeps, drives, and oxidations. 


Predeposition, or “‘predep,” is an operation where a 
dopant is introduced into the furnace from a solid, 
liquid, or gaseous source and at the furnace temper- 
ature (usually 900°C-1200°C) a saturated solution is 
formed at the silicon surface. The temperature of the 
furnace, the dopant atom, and rate of introduction 
are all engineered to give a specific dose of the dop- 
ant on the wafer. Once this is completed the wafer is 
given a drive cycle where the dopant left at the sur- 
face by the predep is driven into the wafer by high 
temperatures. These are generally at different tem- 
peratures than the predeps and are designed to give 
the required junction depth and concentration pro- 
file. 


Oxidation, the third category, is used at many steps 
of the process as was shown in the process flow. 
The temperature and oxidizing ambient can range 
from 800°C to 1200°C and from pure oxygen to mix-' 
tures of oxygen and other gases to steam depending 
on the type of oxide required. Gate oxides require 
high dielectric breakdown strength for thin layers 
(between 0.01 and 0.1 micron) and very tight control 
over thickness (typically + 0.005 micron or less than 
+ 1/5,000,000 inch), while isolation oxides need to 
be quite thick and because of this their dielectric 
breakdown strength per unit thickness is much less 
important. 


The properties of the diffused junctions and oxides 
are key to the performance and reliability of the fin- 
ished device so the diffusion operations must be ex- 
tremely well controlled for accuracy, consistency 
and purity. 


ION IMPLANT 


Intel’s high performance products require such high 
accuracy and repeatability of dopant control that 
even the high degree of control provided by diffusion 
operations is inadequate. However, this limitation 
has been overcome by replacing critical predeps 
with ion implantation. In ion implantation, ionized 


_ dopant atoms are accelerated by an electric field 
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and implanted directly into the wafer. The accelera- 
tion potential determines the depth to which the 
dopant is implanted. 


The charged ions can be counted electrically during 
implantation giving very tight control over dose. The 
ion implanters used to perform this are a combina- 
tion of high vacuum system, ion source, mass spec- 
trometer, linear accelerator, ultra high resolution cur- 
rent integrator, and ion beam scanner. You can see 
that this important technique requires a host of so- 
phisticated technologies to support it. 


THIN FILMS 


Thin film depositions make up most of the features 
on the completed circuit. They include the silicon ni- 
tride for defining isolation, polysilicon for the gate 
and interconnections, the glass for interlayer dielec- 
tric, metal for interconnection and external connec- 
tions, and passivation layers. Thin film depositions 
are done by two main methods: physical deposition 
and chemical vapor deposition. Physical deposition 
is most common for deposition metal. Physical dep- 
ositions are performed in a vacuum and are accom- 
plished by vaporizing the metal with a high energy 
electron beam and redepositing it on the wafer or by 
sputtering it from a target to the wafer under an elec- 
tric field. 


Chemical vapor deposition can be done at atmo- 
spheric pressure or under a moderate vacuum. This 
type of deposition is performed when chemical gas- 
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es react at the wafer surface and deposit a solid film 
of the reaction product. These reactors, unlike their 
general industrial counterparts, must be controlled 
on a microscale to provide exact chemical and phys- 


ical properties for thin films such as silicon dioxide, 
silicon nitride, and polysilicon. 


The fabrication of modern memory devices is a long, 
complex process where each step must be moni- 
tored, measured and verified. Developing a totally 
new manufacturing process for each new product or 
even product line takes a long time and involves sig- 
nificant risk. Because of this, Intel has developed 
process families, such as HMOS, on which a wide 
variety of devices can be made. These families are 
scalable so that circuits need not be totally rede- 
signed to meet your needs for higher perform- 
ance.(1) They are evolutionary so that development 
time of new processes and products can be reduced 
without compromising Intel’s commitment to consist- 
ency, quality, and reliability. 


The manufacture of today’s MOS memory devices 
requires a tremendous variety of technologies and 
manufacturing techniques, many more than could be 
mentioned here. Each requires a team of experts to 
design, optimize, control and maintain it. All these 
people and thousands of others involved in engi- 
neering, design, testing and production stand behind 
Intel’s products. 


(1)R. Pashley, K. Kokkonen, E. Boleky, R. Jecmen, S. Liu, 
and W. Owen, “H-MOS Scales Traditional Devices to High- 
er Performance Level,” Electronics, August 18, 1977. 
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Flash Memory Overview 


The ideal memory system optimizes density, nonvolatil- 
ity, fast readability and cost effectiveness. While tradi- 
tional memory technologies may individually exhibit 
one or more of these desired characteristics, no single 
memory technology has achieved all of them without 
major tradeoffs—until the introduction of Intel Flash 
Memory. 


WHAT IS FLASH MEMORY? 


Introduced by Intel in 1988, ETOX flash memory is a 
high-density, truly nonvolatile and high performance 
read-write memory solution also characterized by low 
power consumption and extreme ruggedness and high 
reliability. The cost trend of Intel Flash Memory com- 
ponents continues to decline sharply due to: (1) manu- 
facturing economies inherent in ETOX, Intel’s indus- 
try-standard EPROM-based flash technology, (2) 
increases in memory density, and (3) rapid growth in 
production volume. 


A comparison between Intel Flash Memory and other 
solid-state memory technologies underscores the fact 
that flash offers a design solution with distinct advan- 
tages. These advantages are key to future product dif- 
ferentiation for many applications requiring firmware 
updates or compact mass storage (Figure 1). 


— ROM (read-only memory) is a mature, high densi- 
ty, nonvolatile, reliable and low cost memory tech- 
nology widely used in PC and embedded applica- 
tions. Once it is manufactured however, the 
contents of a ROM can never be altered. Addition- 
ally, initial ROM programming involves a time- 
consuming mask development process that requires 
stable code and is most cost-effective in high vol- 
umes. 


Easy updatability makes flash memory clearly more 
flexible than ROM in most applications. 


— SRAM (static random-access memory) is a high- 
speed, reprogrammable memory technology which 
is limited by its volatility and relatively low density. 
As a volatile memory technology, SRAM requires 
constant power to retain its contents. Built-in bat- 
tery backup is therefore required when the main 
power source is turned off. Since battery failure is 
an inevitable fact of life, SRAM data loss is an ever- 
present danger. Additionally, SRAM requires four 
to six transistors to store one bit of information. 
This becomes a significant limitation in developing 
higher densities—effectively keeping SRAM cost 
relatively high. 


Figure 1. Intel Flash Memory vs Traditional Memory Technologies 


*MS-DOS and Windows are registered trademarks of Microsoft Corporation. 
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In contrast, Intel flash memory is inherently nonvola- 
tile, and the single transistor cell design of Intel’s 
ETOX manufacturing process is extremely scalable, al- 
lowing the development of continuously higher densi- 
ties and steady cost improvement over SRAM 
(Figure 2). 
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Figure 2 


— EPROM (electrically programmable read-only 
memory) is a mature, high-density, nonvolatile 
technology which provides a degree of updatability 
not found in ROM. An OEM may program 
EPROM as needed to accommodate code changes 
or varying manufacturing unit quantities. Once pro- 
grammed, however, the EPROM may only be 
erased by removing it from the system and then 
exposing the memory component to ultraviolet 
light—an impractical and time-consuming proce- 
dure for many OEMs and a virtually impossible 
task for end-users. 


Unlike EPROM, flash memory is electrically re-writa- 
ble within the host system, making it a much more 
flexible and easier to use alternative. Flash memory of- 
fers OEMs not only high density and nonvolatility, but 
higher functionality and the ability to differentiate their 
systems. 


— EEPROM electrically erasable programmable 
read-only memory) is nonvolatile and electrically 
byte-erasable. Such byte-alterability is needed in 
certain applications but involves a more complex 
cell structure, and significant trade-offs in terms of 
limited density, lower reliability and higher cost, 
making it unsuitable as a mainstream memory. 


Unlike EEPROM, Intel flash memory technology uti- 
lizes a one-transistor cell, allowing higher densities, 
scalability, lower cost, and higher reliability, while tak- 
ing advantage of in-system, electrical erasability (Fig- 
ure 3). 
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Figure 3 


— DRAM (dynamic random access memory) is a vol- 
atile memory known for its density and low cost. 
Because of its volatility, however, it requires not 
only a constant power supply to retain data, but 
also an archival storage technology, such as disk, to 
back it up. 


Partnered with hard disks for permanent mass storage, 
DRAM technology has provided a low-cost, yet space 
and power-hungry solution for today’s PCs. 


With ETOX process technology, Intel manufactures a 
flash memory cell that is 30% smaller than equivalent 
DRAM cells. Flash memory’s scalability offers a price 
advantage as well, keeping price parity with DRAM, 
and also becoming more attractive as a hard disk re- 
placement in portable systems as densities grow and 
costs decline. 


Intel flash memory combines advantages from each of - 
these memory technologies. In embedded memory ap- 
plications, flash memory provides higher-performance 
and more flexibility than ROM and EPROM, while 
providing higher density and better cost effectiveness 
than battery-backed SRAM and EEPROM. Moreover, 
the true nonvolatility and low power consumption 
characteristics of flash memory make it a compelling 
alternative to DRAM in many applications. 


ETOX lil TECHNOLOGY 


Unlike other approaches to flash memory, Intel ETOX 
is a proven technology. As its name suggests, ETOX 
(or “EPROM tunnel oxide’”’) technology evolved from 
EPROM. With 95% process compatibility with 
EPROM, ETOX taps experience gained from a mature 
high-volume manufacturing base pioneered by Intel in 
the 1970s. 


Data retention and lifetime reliability statistics for 
ETOX< III flash are equivalent to those of EPROM. 
Representing the third generation of Intel flash memo- 
ry technology, the ETOX III O.8u process provides 
<100 FITS (failures in time) @ 55°C in a specification 
that delivers 100,000 write cycles per block. This capa- 
bility significantly exceeds the cycling requirements of 
even the most demanding applications. 
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For example, code storage for embedded control pro- 
grams used in standard computer applications is infre- 
quently updated. Twenty-year system lifetimes may re- 
quire fewer than 100 rewrites. Even routinely-changed 
data tables (used in navigational computers and black 
box controllers) only require about 1,000 write cycles 
over a 20-year period. The most demanding flash mem- 
ory application of all, archival data storage in PC appli- 
cations, typically requires about 5,000 write cycles in 20 
years. 


ETOX flash memory’s simple single-transistor cell 
structure makes it smaller than other flash cells, allow- 
ing designers to create highly integrated systems which 
are more reliable and cost-effective than those based on 
more complex and less mature flash technologies. The 
inherent scalability of ETOX III Flash Memory and 
high-volume manufacturing is enabling a correspond- 
ing downtrend in flash cost. 


Flash memory has added a new dimension to nonvola- 
tile memory applications. Embedded systems, such as 
PC BIOS, hard disk drive controllers and cellular tele- 
phone applications take advantage of the easy update 
capability, high density and high performance of Intel 
Flash Memory. Today’s new generation of portable 
computers require the optimum combination of per- 
formance, size, weight, low power and shock resistance. 
Whether implemented in memory cards, solid state 
disks or at the component level, Intel’s Flash Memories 
are also enabling a whole new generation of mobile 
computers. 


IMPLEMENTING INTEL FLASH 
MEMORY 


Today, Intel continues to serve both updatable nonvol- 
atile memory applications as well as the rapidly emerg- 
ing solid-state mass storage applications with flash 
memory solutions tailored to meet the needs of these 
markets. 


Updatable Code Storage 


Code and data storage comprise the updatable nonvola- 
tile memory applications that require high perform- 
ance, high density, and easy update capability. Because 
these applications are not updated as frequently as sol- 
id-state mass storage applications, erase/write cycles 
are not as critical as integration and performance re- 
quirements. This application segment is served effec- 
tively with full chip-erase or Boot Block products. 


* Based on 10 MB card design, 5,000 cycle yields 50,000 MB of stored 
data, which far exceeds most usage environments and file system 
methodologies. 
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Intel’s 28FO01BX 1 Mbit Boot Block flash component, 
featuring a sectored architecture, has been widely ac- 
cepted in embedded code storage applications, particu- 
larly in PC BIOS and cellular communications. By 
adopting Boot Block for their products, over 20 PC 
manufacturers have gained added flexibility and the 
ability to differentiate in a highly competitive market. 
End users also benefit from the ability to upgrade BIOS 
software quickly and securely. The blocked architec- 
ture allows the OEM to store critical system code se- 
curely in the lockable “boot block” of the device that 
can minimally bring up the system and download to 
other locations of the device to initialize the system. 
The hardware boot locking feature guarantees that even 
if the power is disrupted during a BIOS update, the 
system will be able to recover immediately. 


In response to customer requests for speed, density, low 
power, surface-mount options and an industry-standard 
upgrade path for portable computing and telecommuni- 
cations, Intel more recently introduced the 2 Mbit 
28F200BX and 4 Mbit 28F400BX Boot Block prod- 
ucts. 


These products offer 60 ns performance; two surface 
mount packages: 40-lead TSOP (X8 only) and 44-lead 
PSOP; and a proprietary Boot Block architecture simi- 
lar to the 1 Mbit Boot Block device. The Boot Block 
stores the code necessary to initialize the system, while 
parameter blocks can be used to store manufacturing 
product code, setup parameters, and frequently updat- 
ed code such as system diagnostics. The main operating 
code is stored in the main blocks. Both devices are 
available in a x16/x8 ROM-compatible pin-out in 
44-lead PSOP surface mount packaging. These pinouts 
and packages allow an easy upgrade from 2 Mb to 
4 Mb, since only one address is added to the 4 Mb 
device. 


Solid-State Mass Storage 


This major application segment requires very high den- 
sity memory, automated programming and high-per- 
formance erase/write capability at a very low cost per 
bit. Erasing and writing portions of the code or data is 
much more frequent in solid-state mass storage than in 
updatable firmware applications. 


Intel’s symmetrically blocked 8 Mbit 28FOO8SA Flash- 
FileTM memory is the highest density nonvolatile read/ 
write solution for solid-state mass storage. What’s - 
more, it is the first flash memory device optimized for 
solid-state storage of software and data files. 


The 28FOO8SA is packaged in an advanced 40-lead 
TSOP (thin, small outline package) or 44-lead PSOP 
(plastic SOP) to provide the extremely small form fac- 
tor required for today’s handheld, pen-based and sub- 
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FLASH MEMORY OVERVIEW 


notebook portable computers. The compactness of an 
8 Mbit device in a TSOP package allows for high-densi- 
ty flash arrays to be included both on a system mother- 
board for direct execution of user programs or operat- 
ing systems, as well as memory cards for transportable 
program and file storage. 


Memory Cards 


Intel’s family of flash memory cards provides the most 
reliable and rugged form of removable memory media. 
High density, true nonvolatility, rewrite flexibility, and 
proven cost effectiveness make Intel Series 1 Flash 
Memory Cards the ideal medium for storing and updat- 
ing application code as well as capturing data. 


For file storage applications that require high perform- 
ance, ruggedness, long battery life, small size and light 
weight, Intel’s Series 2 Flash Memory Cards in 
4-Mbyte, 10-Mbyte and 20-Mbyte densities provide the 
best solution. Based on Intel’s 8-Mbit FlashFile memo- 
ry components, the Series 2 card’s block-erase function- 
ality and high density take full advantage of flash filing 
systems like Microsoft*’s Flash File System software to 
provide full disk emulation in the form of removable, 
nonvolatile storage. The cards conform to the 
PCMCIA 2.0/JEIDA 4.1 68-pin standards and are 
compatible with Intel’s Exchangeable Card Architec- 
ture (ExCAT™) to ensure system-to-system interopera- 
bililty. 


THE IMPETUS BEHIND THE “SOLID- 
STATE” DISK 


Because the disk-based PC is so prevalent and eminent- 
ly familiar to both designers and end-users, many of 
today’s portable systems still rely on it as their primary 
medium. At the same time, disk drive manufacturers 
have made great strides toward improving the reliabili- 


Average Seek Time 


Data Transfer Rate 


Disk/DRAM 
eSNG oC i ie is Le MOREA, Se Riperiw en Lene 


Read: 8 Mbits/sec. 106.7 Mbits/sec. 
Write: 8 Mbits/sec. 1 Mbit/sec. 
... Now Read from RAM Direct Processor Access 


Total Time to Access 37.3 ms 0.077 ms 
(1 Kbyte File) 


a F 
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ty, size and performance of their systems, as well as the 
disk media themselves. 


Yet the disk drive is an electro-mechanical system with 
inherent limitations. Any mechanical hardware is much 
more vulnerable than solid state semiconductor tech- 
nology to the shock, vibration, and impurities that por- 
table PCs encounter during normal use. Hard disk 
drives can typically withstand up to 10Gs of operating 
shock; Intel FlashFile memory, with no moving parts, 
can withstand as much as 1000Gs. Additionally, Intel’s 
Series 2 Memory Cards feature approximately 1.6 mil- 
lion hours mean time between failure (MTBF). Such 
endurance and reliability is essential for many of to- 
day’s truly mobile handheld palmtop and notebook 
sized PCs, particularly within applications requiring ex- 
treme data integrity. 


Power consumption is another major consideration for 
today’s mobile PC designer and user. The drive typical- 
ly requires anywhere from 3 watts to as many as 
8 watts of power to run—which means rapid drain of 
the system’s batteries. Compare this to flash memory in 
a hard disk configuration. It consumes less than one 
two-hundredth the average power of a comparable 
magnetic disk drive based on the typical user model. At 
the chip level, the 8 Mbit FlashFile Memory compo- 
nent has a DEEP POWERDOWN mode that reduces 
power consumption to less than 0.2 pA. 


Additional shortcomings of disk drives are their size, 
weight and floor costs. Magnetic drives do not scale 
well, that is, it becomes increasingly difficult to im- 
prove or even retain density as platter size shrinks. 
Thus, every reduction in drive size requires complete 
retooling and costly learning. Also, the complex con- 
troller circuitry provides a price floor under which 
magnetic drives cannot drop. Since flash is scalable, at 
some point in the near future, small magnetic drives are 
likely to become more expensive per Mbyte than flash 
cards and are certain to have less capacity. 


Figure 4 
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From a performance standpoint, disk-based systems 
still require some form of supplementary memory that 
is directly executable. Typically, DRAM is used for ex- 
ecutable code storage and data manipulation. Data 
from the disk is downloadable into the DRAM cache 
before users can access the information. Then when a 
“save” operation is desired, the data is uploaded from 
DRAM back into the disk. This download/upload pro- 
cess slows down system throughput while the redun- 
dant memory media produce even more system over- 
head in the form of added space, power consumption 
and weight (Figure 4). 


Today’s PCs are typically configured with 
4 Mbytes—8 Mbytes of DRAM backed up by at least a 
40-Mbyte disk. FlashFile memory fully supports this 
system configuration when used simply as a magnetic 
drive replacement. Instructions and data are still 
swapped to DRAM, but at a faster rate. Plus execution 
speed can be enhanced if the DRAM is replaced with 
SRAM. 


In the solid-state computer, the “DRAM + magnetic 
hard drive” is replaced by a “flash memory + 
SRAM”. The key to this architecture is the ability to 
eXecute-In-Place (XIP). Program instructions stored in 
flash memory are read directly by the processor. Re- 
sults are written directly to the flash memory. Com- 
pute-intensive operations that require the fastest memo- 
ry access and byte-alterability can use high-speed 
SRAM or pseudo SRAM. Some of the system DRAM 
can be replaced by low-cost flash and a small part of 
the DRAM can be replaced by SRAM. The flash mem- 
ory space is made even more storage efficient through 
the use of compression techniques which may offer up 
to 2:1 compression. 


SOFTWARE DEVELOPMENTS | 
POSITION FLASH FOR PORTABLE 
APPLICATIONS 


The majority of today’s portable computers and sup- 
porting software programmers are designed to run us- 
ing Microsoft’s MS-DOS* disk operating system. MS- 
DOS was developed to allow broad-based compatibility 
between systems and software and to optimize the sec- 
toring scheme inherent to disk technology. 


Intel’s Flash Memory, based on a block-erase architec- 
ture, divides the flash memory into segments that are 
loosely analogous to the zones recognized in MS-DOS. 
Thanks to recent software developments, flash memory 
can effectively serve as the main memory within porta- 
ble computers, providing user functions virtually identi- 
cal to, and even improved over, those of disk-based sys- 
tems. 


FLASH MEMORY OVERVIEW 


Specifically, two recent developments allow this 
achievement: DOS in ROM-executable form (DOS was 
formerly designed to be stored on disk and then down- 
loaded to/executed out of RAM); and a file system de- 
signed for flash memory technology that allows the de- 
vices to erase blocks of memory instead of the whole 
chip. 


ROM.-executable DOS provides several benefits to both 
system manufacturers and ultimately end users. First, 
since most of the operating system is composed of fixed 
code, the amount of system RAM required to execute 
DOS is reduced from 50K to 15K, thereby conserving 
system space and power. Secondly, DOS can now be 
permanently stored in and executed from a single 
ROM-type of device—flash memory—so systems come 
ready to run. Lastly, users enjoy “instant on” perform- 
ance since the traditional disk-to-DRAM boot function 
and software downloading steps are eliminated. 


For example, by storing application software and oper- 
ating system code in a Resident Flash Array (RFA), 
users enjoy virtually instant-on performance and rapid 
in-place code execution. An RFA also protects against 
software obsolescence because it is in-system updatable. 
Resident software, stored in flash rather than disk, ex- 
tends battery life and increases system reliability. 


Since erasing and writing data to flash memory is a 
distinctly different operation than rewriting informa- 
tion to a disk, new software techniques were necessary 
to allow flash to emulate disk functionality. File man- 
agement software like Microsoft*’s Flash File System 
(FFS) allows Intel’s Flash Memory components and 
flash cards to emulate the file storage capabilities of 
disk. Microsoft’s FFS transparently handles data swaps 
between flash blocks similar to the way MS-DOS han- 
dles swaps between disk sectors. Under FFS, the user 
may input a MS-DOS or Windows* command without 
regard for whether a flash memory or magnetic disk is 
installed in the system. The FFS also employs wear-lev- 
eling algorithms that prevent any block from being cy- 
cled excessively, thus assuring millions of hours of reli- 
ability. Flash filing systems make the management of 
flash memory devices completely transparent to the 
user. 


CONCLUSION 


Intel Flash Memory presents an entirely new memory 
technology alternative. As a high-density, nonvolatile 
read/write technology, it is exceptionally well-suited to 
serve as a solid-state disk or a cost-effective and highly 
reliable replacement for DRAMs and battery-backed 
static RAMs. Its inherent advantages over these tech- 
nologies make it particularly useful in portable systems 
that require the utmost in low power, compact size, and 
ruggedness while maintaining high performance and 
full functionality. 
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Intel Flash Memory offers: 


¢ Inherent Nonvolatility: Unlike static RAMs, no 
backup battery is required to ensure data retention. 
In contrast to DRAMs, flash requires no disk to 
provide backup storage of data, programs or files. 


® Cost-Effective High Density: Today, Intel flash 
memories cost about the same as DRAMs and 
about one fourth of SRAMs on a per-bit basis. The 
broad acceptance of flash is driving manufacturing 
volumes up and costs down at an unprecedented 
rate, allowing flash to soon compete on a cost basis 
even with disk drive within the notebook, sub-note- 
book and palmtop markets. 


¢@ Solid-State Performance: Because it is a semicon- 
ductor technology, flash memory consumes much 
less power, is much lighter in weight and is smaller 
and more shock-resistant and reliable than disk 
drives. Mobile computers no longer have to drain 
the battery to run a disk drive motor or accommo- 
date the disk assembly’s added bulk and weight. 
Now users no longer have to be threatened with the 
possibility of losing their data after a disk crash 
when conditions become unusually rough. 


® Direct Execution: Since no disk-to-DRAM down- 
load step, seek or latency times are incurred with 
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flash memory, users enjoy significantly higher speed 
program and file access, as well as systems that turn 
on instantly to wherever the user left off. 


Easy Updatability: Unlike other nonvolatile memo- 
ry technologies—ROM that can never be altered af- 
ter it is manufactured or EPROM that can only be 
erased by removing it from the system and exposing 
it to ultraviolet light—flash can be erased and repro- 
grammed electrically while resident in the host sys- 
tem. 


Software Compatibility: With Flash File System 
software and ROM-executable versions of the disk 
operating system (DOS), complete software compat- 
ibility between a user’s desktop and portable system 
is ensured. 


Exchangeable Card Architecture (ExCAT); 
Through Intel’s ExCA card interface standard, In- 
tel’s flash memory cards meet all specifications of 
PCMCIA 2.0, ensuring interchangeability between a 
host of PCMCIA-compatible systems. 


Family of Products: Intel Flash Memory products 
are currently available in component densities up to 
8 Mbits, and in 4-Mbyte, 10-Mbyte and 20-Mbyte 
memory cards. Additionally, Intel offers Boot Block 
devices in densities up to 4 Mbits. 
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1.0 INTRODUCTION 


Intel flash memory is rapidly being incorporated into a 
wide range of applications, adding enhanced capability 
to existing “traditional” memory markets, and creating 
new markets that exploit its benefits. Sometimes the 
design platforms may not possess the low powered 12V 
supply for writing flash memory. The system design 
engineer then needs to identify a power conversion so- 
lution with features and capabilities matching the needs 
of the application. For example, portable equipment re- 
quires a power supply converter that minimizes size 
and weight, maximizes efficiency to extend battery life, 
and can be switched into a standby mode to conserve 
power. 


The following pages present some state of the art DC- 
DC converter solutions. These new solutions are small- 
er and more efficient than those typically seen in the 
past. Each of these solutions optimizes a subset of all 
possible power converter features. The choice of an op- 
timal solution for a given application will be a tradeoff 
between several attributes. The solutions shown should 
meet the conversion needs of the majority of applica- 
tions involving flash memory. Specifically, the solutions 
that follow encompass the following five categories: 


@ 5V to 12V conversion 

@ 3V (2 alkaline/NiCd cells) to 12V conversion 
@ 3V (2 Alkaline/NiCd cells) to 5V conversion 
© Downconverting to 12V from a higher voltage 
® Converting 12V unregulated to 12V regulated 


More than one solution is presented within each of 
these categories. These different solutions have distinct 
optimal features/advantages. The optimal attributes of 
each solution are outlined. In addition, the appendix 
contains a survey of all solutions presented here, and 
provides a basis for comparing their features. The read- 
er should reference it to choose an optimal solution for 
his/her application. 


NOTE: 

Solutions were selected from products offered by over 
thirty DC-DC converter vendors. Since this industry 
develops many new solutions each year, Intel recom- 
mends that designers contact vendors for latest prod- 
ucts. Intel will continue to work with the industry to 
develop optimum solutions for power conversion. Intel 
Corporation assumes no responsibility for circuitry 
other than circuitry embodied in Intel products. No 
other circuit patent licenses are implied. 
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2.0 INTEL FLASH MEMORY POWER 
REQUIREMENTS 


Intel flash memory is powered by two sources; a 5V 
Vcc line and a 12V Vpp line. Vcc is the primary pow- 
er source and the only power source needed to read the 
memory. Vpp is required when writing or erasing the 
memory. 


Vcc Characteristics 


Vcc supplies power to the flash device during all oper- 
ational modes. Maximum Vcc current is demanded by 
the device during the read operation. The data sheets 
for all Intel flash memory devices at the time this appli- 
cation note was written specify a maximum read cur- | 
rent (Icc) of 30 mA at 5V +10%. This is the guaran- 
teed worst case DC Vcc current that may be required 
by a flash device for reading one byte of data. If multi- 
ple components are read simultaneously, the Vcc cur- 
rent requirement increases proportionately. Vcc toler- 
ance must be maintained to within specification limits 
at all times for proper functioning of the device. 


Vpp Characteristics 


The supplemental Vpp source provides the higher volt- 
ages needed to carry out the erase, erase verify, pro- 
gram, and program verify operations. Maximum Vpp 
current is typically demanded during the program and 
erase modes. Data sheets for all Intel flash memory 
devices at the time this application note was written 
specify a maximum Ipp current of 30 mA at 12V +5% 
for both program and erase operations. This is the 
guaranteed worst case Vpp supply current that will be 
required by a flash device for writing one byte of data 
or erasing one block/component. If multiple compo- 
nents are programmed/erased simultaneously, the cur- 
rent requirement increases proportionately. Vpp must 
be maintained to within specification limits at all times 
during device program, and erase. The tolerance speci- 
fication on Vpp must be strictly maintained. Over-volt- 
age can damage the device, and under-voltage can de- 
crease specified device reliability. Although the 12V 
supply must meet these worst case specifications, power 
usage will typically be much lower. The lower typical 
values seen in the data sheets should be used in calcu- 
lating typical battery life. 
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2.1 Supplies for Battery Powered 
Applications 


In applications where batteries are the primary source 
of power, the power supplies providing Vcc and Vpp 
need to be selected very carefully. Optimized operating 
efficiency of these supplies is important to extend bat- 
tery life. Another attractive feature is the capability of 
these supplies to be switched into a very low power 
shutdown mode. It is important to minimize this shut- 
down current consumption as well since flash memory 
Vpp generators will often be in this state for extended 
periods of time. Moreover, since these supplies are used 
in equipment that is physically small and space-con- 
strained, size and height of the supply need to be mini- 
mized. 


Where two alkaline/NiCd batteries are used as the pri- 
mary source of power, the primary voltage varies de- 
pending on the type and the state of discharge of the 
batteries. For example, alkaline batteries start life off at 
1.5V, but may still retain a significant amount of energy 
when the voltage falls to 1.0V with use, and will work 
all the way down to 0.8V. On the other hand, NiCd 
cells maintain a near constant voltage of 1.25V 
throughout most of their discharge cycle, and work 
down to 1.0V. A solution that derives Vcc or Vpp from 
2 AA batteries must hence be capable of doing so from 
an input voltage that lies in the range of 1.6V to 3.0V. 


It is best to directly convert the primary battery voltage 
into the various voltages needed throughout the system. 
A step conversion (e.g. a 3V to 5V converter for Vcc, 
followed by a 5V to 12V converter for Vpp) is not rec- 
ommended, since the inefficiency involved in each con- 
version step combines into one large inefficiency for the 
sum 3V to 12V conversion. Section 4 presents appropri- 
ate 3V battery to 12V converter solutions. Most of the 
solutions presented in this application note, while spe- 
cifically designed for battery powered applications, are 
also viewed as ideal for other applications that incorpo- 
rate flash memory. 


2.2 Choice of a DC-DC Converter 


The solution to finding the right power supply for flash 
memory lies in picking the right DC-DC converter for 
the job. Two broad categories of DC-DC converters 
available in the market today can be applied towards 
this purpose. These are the low power hybrid DC-DC 
converter module (or modular solution), and the low 
power discrete switching regulator IC solution. 
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The Modular Solution 


The modular solution generally consists of a push-pull 
(Royer type) oscillator built around an isolation trans- 
former, and in some cases followed by a linear regula- 
tor; all of which is encapsulated within a module. This 
hybrid module includes all components that are re- 
quired by the DC-DC converter, and so no additional 
design effort is needed. The input and output voltages 
are fixed, and the input and output are almost always 
isolated via the isolation transformer. The main advan- 
tage of these solutions is that no design effort and/or 
external components are involved. They simply plug 
into a socket on a PC board. Disadvantages include 
lower efficiency (generally 60%), larger size/height (in 
most cases), and higher cost (generally 3x to 10x the 
cost of discrete solutions). 


It would seem that the integration inherent in these 
solutions contributes towards system reliability, howev- 
er the type and quality of the discrete components used 
internal to these hybrid devices is open to question. The 
isolation offered between the input and output is viewed 
as overkill for flash applications, since the total power 
required is typically less than 1W. Note also that the 
isolation transformer is often the r main reason for the 
lower efficiencies. 


The Discrete Switching Regulator 
Solution 


The discrete switching regulator IC solution consists of 
a DC-DC converter IC (containing a switching regula- 
tor controller and an output power switch), along with 
a few discrete external components (inductor, diode, 
capacitors, resistors, etc.). The layout of the power sup- 
ply system in this case is mostly left up to the user. 
However, application notes and data sheets explain the 
design process, and provide recommended circuits for 
commonly used solutions. The design can be tailored to 
deliver different output voltages and current levels de- 
pending on the characteristics of the input voltage and 
the external components. 


Some vendors offer fixed output voltage versions, fur- 
ther simplifying the design process. The newer genera- 
tion of high frequency low power switching regulator 
ICs are specifically targeted at battery powered opera- 
tion, and most can be switched into a low quiescent 
current shutdown mode to extend battery life. These 
have typical efficiencies in the 75% to 90% range. Fur- 
thermore, the higher switching frequencies of these new 
parts (typically 100 KHz to 200 KHz) allow the use of 
smaller external components, which are available in 
surface mount varieties. As a consequence, these newer 
solutions are overall much smaller than what was typi- 
cally seen just a year ago. 
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Attributes of a DC-DC Converter 


Several attributes of a power supply converter must be 
evaluated and prioritized when choosing the best solu- 
tion for a given application. These attributes include: | 


@ Input Voltage Range 


Shutdown Capability 


Rise Time from Shutdown 
Surface Mountability 


Quiescent Current Consumed in Shutdown Mode 


The reader is referred to Appendix B, which provides a 
survey of all the solutions that are presented in this 
application note, in order to compare their attributes. 
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NOTE: 
External components recommended in the designs 
should be used. These components (inductors, capaci- 
tors, resistors) were chosen based on recommendations 
by the converter IC vendors and provide the necessary 
quality for a clean design. Alternate “equivalent” 
parts should be chosen with care as their resistive and 


Output Voltage and Tolerance inductive elements can affect the operation of the solu- 

Output Current Capability tion. Please contact the respective converter IC com- 

Efficiency of Conversion panies for assistance if you select an alternate value/ 
source for passive components. 

Printed Circuit Area 

Height 

blieaNs ch 3.0 Vpp SOLUTIONS: CONVERTING 


UP FROM 5V 


Most computer systems have available a 5V Vcc line 
that is used for the majority of system power. Frequent- 
ly, this 5V supply is used to generate 12V for flash 
memory. This section presents some of the new state of 
the art solutions that can achieve this function. These 
are all discrete switching regulators that optimize dif- 
ferent attributes, mentioned along with the main fea- 
tures section of each example. Refer to Appendix B for 
a more detailed comparison of the attributes of these 


This application note primarily presents state of the art 


solutions. 


discrete switching regulator IC solutions which have 
been carefully designed for operation with flash memo- 
ry. Included along with schematics are component val- 
ues and sources/contacts for obtaining all the compo- 
nents. Actual layouts have also been included where 
possible. These are provided in Appendix F. 


3.1 Maxim Integrated Products—MAX732: Vpp @ 30 mA, 60 mA, 120 mA 
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Figure 3-1. Maxim MAX732 5V to 12V Converter 
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Optimal Attributes The MAX732 design as shown is capable of providing 
up to 120 mA of Vpp current at an efficiency of 90%. 

© Highest Efficiency | The 5V input should be able to source the peak currents 
©. Low Sintdawn Carrent and start-up currents required by the circuit. This con- 
verter circuit can also run directly off a 6 cell NiCd 

° Wide Input Voltage Range pack present on many notebook/laptop computers. It is 
@ All Surface Mount available in a 16-pin wide SOIC package, and uses 
small external surface mount components (5 in all). 

Voltage spikes may be present in the output due to 
incorrect layout, excessive output filter capacitor ESL 
(Equivalent Series Inductance) and diode switching 
transients. The optional filter circuit is recommended to 
Output Voltage: 12V +4% eliminate any sharp transients. The supply can be 
Output Current Capability: Up to 120 mA switched into a shutdown mode where the output volt- 


e 
e 
® 
© Typical Efficiency: 90% at ILgap = 60 mA age falls to approximately Voc — 550 mV. A layout is 
e 
@ 
@ 


Main Features 


Input Voltage Range: 4V to 7.5V 


presented in Appendix F. Applications assistance and a 
170 KHz Operation surface mount evaluation kit is also available from 
Shutdown Feature On Chip Maxim. 


Low Quiescent Current at Shutdown: 70 A typical 
© Low Operating Quiescent Current: 1.6 mA typical 


® Rise Time from Shutdown: 1 ms Typical 


@- Will Work off Existing SV Supply or a 6 NiCd Bat- 
tery Pack 


Table 3-1. Parts List for the MAX732 5V to 12V Converter 


1 MAX732CWE SMPS IC Maxim 
(408) 737-7600 
1 267M1002-336-MR-720 33 F/10V Matsuo | $0.31 
Tantalum (714) 969-2491 
2 267M1602-336-MR-720 33 wF/16V Matsuo $0.31 
Tantalum (714) 969-2491 
3 C4532C0G1H472K 4700 pF TDK $0.04 
(708) 803-6100 
4 GRM40Z5U104M050AD 0.1 pF Murata Erie $0.06 
(404) 436-1300 
D1 
L1 


Ri, R2 9C08052A1ROOJLR 1.00, 5% Philips $0.04 
(817) 325-7871 

MBRS120T3 Schottky Diode Motorola $0.30 
(800) 521-6274 

CD54-180 18 wH Sumida $0.38 
(708) 956-0666 


Total Cost YS apes] 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 
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3.2 Linear Technology LT1110-12: Vpp @ 30 mA, 60 mA, 120 mA 
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Figure 3-2. Linear Technology LT1110-12 5V to 12V Converter 


Optimal Attributes 

® Small Size: 0.45 sq. in. Total Board Area (Single 
Sided) 

© Very Low Shutdown Current: 16 pA 

e All Surface Mount 


Main Features 


Input Voltage Range: 4.5V to 5.5V 
Output Voltage: 12V +5% 

Output Current Capability: Up to 120 mA 
Typical Efficiency: 76% 

60 KHz Operation 


Shutdown Possible Using External Components as 
Shown 


Low Quiescent Current at Shutdown: 16 wA typical 
© Rise Time from shutdown: 800 ps typical 


The Linear Technology LT1110-12 is a fixed 12V out- 
put part which is well suited to flash memory applica- 
tions. The part is available in a small 8-pin surface 
mount (SO8) package. The part needs 7 external com- 
ponents to implement a small size 5V to 12V converter 
solution that can be shutdown to a very low quiescent 
current state—16 mA typical. The 5V source must be 
capable of supplying the instantaneous start-up and 
peak currents required during operation. Voltage spikes 
may be present in the output due to incorrect layout, 
excessive output filter capacitor ESL (Equivalent Series 
Inductance) and diode switching transients. The op- 
tional RC filter circuit is recommended in order to 
eliminate these sharp transients. The output voltage 
during shutdown falls to approximately Vin — 
550 mV. A recommended board layout appears in Ap- 
pendix F. Applications assistance is available from Lin- 
ear Technology Corporation. 
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Table 3-2. Part List for the LT1110-12 5V to 12V Converter 


[Ret | —sPart#~=~—~—S=«Y «SC alueType =| Source —=«|—Cost*™ | 
U1 LT1110-12 SMPS IC Linear Tech $2.60 
(408) 954-8400 
C1 267M1002-226-MR-720 22 wF/10 V Matsuo 
Tantalum (714) 969-2491 
C2 267M1602-336-MR-720 33 wF/16 V Matsuo $0.31 
Tantalum (714) 969-2491 
C3 GRM40Z5U104M050AD 0.1 pF Murata Erie $0.06 
(404) 436-1300 
MBRS120T3 Schottky Diode Motorola $0.30 
(800) 521-6274 


CDR105-470 47 wH Shielded Sumida $0.40 
(708) 956-0666 

9C08052A3001JLR 3 KN, 5% Philips $0.02 
(817) 325-7871 

9C08052A1002JLR 10 KN, 5% Philips $0.02 
(817) 325-7871 

9C08052A1ROOJLR 10, 5% Philips $0.04 
(817) 325-7871 

MMBT4403LT1 2N4403 PNP Motorola $0.09 
Transistor (800) 521-6274 


Total Cost | $4.07 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 


3.3 Linear Technology LT1109-12: Vpp @ 30 mA, 60 mA 
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Figure 3-3. Linear Technology LT1109-12 5V’to 12V Converter 
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Optimal Attributes | The Linear Technology LT1 109-12 is a fixed 12V out- 

put part which is very well suited to flash memory ap- 
@ Smallest Size plications. The part is available in a very small 8-pin 
© Low Shutdown Current surface mount (SO8) package. The part needs just 4 


small external components to implement an extremely 
small size 5V to 12V converter solution that can be 
shutdown to a low quiescent current state—375 uA 


@ All Surface Mount 


Main Features typical. The 5V source must be capable of supplying the 
instantaneous start-up and peak currents required by 
¢ Input Voltage Range: 4.5V to 5.5V the operation. Voltage spikes may be present in the out- 
‘ ; + put due to incorrect layout, excessive output filter ca- 
eich dl aes as ss iss pacitor ESL (Equivalent Series Inductance) and diode 
© Output Current Capability: Up to 60 mA switching transients. The optional RC filter circuit is 
© Typical Efficiency: 84% recommended in order to eliminate these sharp tran- 
- ; . sients. The output during shutdown falls to approxi- 
of ona mately Vin — 550 mV. A typical board layout is pre- 
¢ Shutdown Feature On Chip sented in Appendix F. Applications assistance is avail- 
© Low Quiescent Current at Shutdown: 375 nA able from Linear Technology Corporation. 
typical 


Rise Time from shutdown: 800 ps typical 
© Small Size: SO8 plus 4 small external components 


Table 3-3. Parts List for the LT1109-12 5V to 12V Converter 


U1 LT1109-12 SMPS IC Linear Tech $2.37 
(408) 432-1900 
C1 267M1002-226-MR-720 22 wF/10V Tant Matsuo 
Chip Capacitor (714) 969-2491 
C2 267M2502-106-MR-720 10 wF/25V Tant Matsuo $0.29 
| Chip Capacitor (714) 969-2491 


GRM40Z5U104M050AD 0.1 wF Murata Erie $0.06 
(404) 436-1300 
MBRS120T3 Schottky Diode Motorola $0.30 
(800) 521-6274 
Ri, R2 9C08052A1ROOJLR 10, 5% | Philips $0.04 
(817) 325-7871 
L1 CD54-330 33 wWH Sumida 
(708) 956-0666 


| Total Cost _ 
*Cost estimates based on published 10K unit pricing at the time this application note was written. 
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3.4 Motorola MC34063A: Vpp @ 30 mA, 60 
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Figure 3-4. Motorola MC34063A 5V to 12V Converter 


Optimal Attributes 


© Lowest Cost 
@ Very Low Shutdown Current 
e All Surface Mount 


Main Features 


Input Voltage Range: 4.5V to 5.5V 

Output Voltage: 12V +5% 

Output Current Capability: Up to 120 mA 
Typical Efficiency: 80% 

100 KHz Operation 

Shutdown Feature Using External Components 


Low Quiescent Current at Shutdown: 25 pA typical 


Rise Time From Shutdown: 2 ms typical 


SO8 Plus 11 Small External Components—All 
SMD 


' 


2-16 


The Motorola MC34063A solution presented uses 11 
small sized external components to implement a low 
cost surface mount 5V to 12V converter solution. Three 
external components (U2, R4, R5) are used to shut 
down supply to the part when Vpp is not needed. These 


- could be eliminated to further lower the cost if power 


consumption is not important. The quiescent current in 
shutdown state is a low 25 wA. The output voltage in 
shutdown is Vcc — 550 mV. Voltage spikes may be 
present in the output due to incorrect layout, excessive 
output filter capacitor ESL (Equivalent Series Induc- 
tance) and diode switching transients. The optional RC 
filter circuit is recommended in order to eliminate these 
sharp transients. Applications assistance is available 
from Motorola. 


intel y : AP-357 


Motorola 
(800) 521-6274 


(Philips 
(817) 325-7871 


C1 267M1002-336-MR-720 | 33pF/16V_ . Matsuo $0.28 
Tantalum (714) 969-2491 

C2 267M1602-336-MR-720 33 wF/16V Matsuo $0.31 
Tantalum (714) 969-2491 

C3 GRM40X7R301M050AD 300 pF Murata Erie $0.03 , 
| (404) 436-1300 

C4 GRM40Z5U104M050AD 0.1 pF Murata Erie - $0.06 
(404) 436-1300 

MBRS120T3 Schottky Diode Motorola $0.30 
. (800) 521-6274 

CD54-470 47 wH Sumida $0.37 
(708) 956-0666 

MMBT4403LT1 PNP Transistor Motorola $0.09 
(800) 521-6274 


Total Cost ROR id 


* Cost estimates based on published 10K unit pricing at the time this application note was written. 


4.0 Vpp SOLUTIONS: CONVERTING voltage is down near 1.8V. Currently there exist two 


UP FROM 2 NiCd/ALKALINE good solutions that achieve a 12V output with inputs as 
CELLS low as 1.8V, and yet supply at least 30 mA of current. 


These are the LT1110-12 from Linear Technology Cor- 
poration, and the MAX732 from Maxim Integrated 


Palmtop computers that use 2 alkaline/NiCd batteries 
Products. 


require that the system work even when the battery 


AP-357 


4.1 Linear Technology LT1110-12: Vpp @ 30 mA from 2 AA Cells 
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Figure 4-1. Linear Technology LT1110-12 3V to 12V Converter 


Optimal Attributes 


@ Smallest Size 
© Low Shutdown Current 
e All Surface Mount 


Main Features 


e Input Voltage Range: 2.0V to 3.1V 

© Output Voltage: 12V +5% 

¢ Output Current Capability: Up to 30 mA 

© Typical Efficiency: 70% 

© 60 KHz Operation 

e Shutdown Mode Using External Components 

¢ Low Quiescent Current at Shutdown: 16 pA typical 
e Rise Time from Shutdown: 4 ms typical 
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The LT1110-12 from Linear Technology Corporation, 
as shown, can be used to generate Vpp from an input 
voltage between 2.0V and 3.1V (most of the usable life 
of 2 alkaline/NiCd cells in series). This design is similar 
to the 5V to 12V converter design presented in Section 
3.2. Replacing L1 and C2 with a lower inductance and 
a higher capacitance, respectively, allows the part to 
work down to 2.0V, while reducing the output current 
capability to 30 mA. The external PNP transistor is 
used to shut off the input supply to the converter IC, 
and puts the part in shutdown state. Note that a disad- 
vantage of this scheme of shutdown is that the control 
signal source sinks approximately 5 mA (Vcc/1K) 
when the part is not in shutdown. However, the quies- 
cent current in shutdown state is a low 16 wA. See 
Appendix E for an alternate shutdown solution. The 
output voltage in shutdown falls to approximately Vyj 
— 550 mV. Voltage spikes may be present in the output 
due to incorrect layout, excessive output filter capacitor 
ESL (Equivalent Series Inductance) and diode switch- 
ing transients. The optional RC filter circuit is recom- 
mended in order to eliminate any sharp transients. A 
surface mount layout appears in Appendix F. 
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Table 4-1. Parts List for the LT1110-12 3V to 12V Converter 


[Ref | ~—sPart# ~=~=—=—=S=*«WY~Ss«Calue/Type | —=—sSource—=«|~-—=sCost® —_ 
U1 LT1110-12 SMPS IC Linear Tech $2.60 
(408) 954-8400 | 
C1 267M1002-220-MR-720 22 wF/10V Matsuo ~ 
! Tantalum (714) 969-2491 
C2 267M1602-470-MR-720 47 wF/16V Matsuo $0.47 
Tantalum (714) 969-2491 
C3 GRM40Z5U104MO050AD 0.1 wF Murata Erie $0.06 
(404) 436-1300 


MBRS120T3 Schottky Diode Motorola $0.30 
(800) 521-6274 

CD54-220 22 wH Sumida $0.37 
(708) 956-0666 

9C08052A3001JLR 3 KO, 5% Philips $0.02 
(817) 325-7871 

9C08052A1002JLR 10 KO, 5% Philips $0.02 
(817) 325-7871 

R3, R4 9C08052A1ROOJLR 10, 5% Philips $0.04 
(817) 325-7871 

U2 MMBT4403LT1 2N4403 PNP Motorola $0.09 
Transistor (800) 521-6274 


Total Cost $4.20 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 


4.2 Maxim Integrated Products—MAX732: Vpp @ 30 mA ) 
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Figure 4-2. Maxim MAX732 3V to 12V Converter (30 mA) 
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Optimal Attributes The MAX732 circuit as shown here can provide up to 

30 mA at 12V from an input voltage as low as 1.8V. 
© Highest Efficiency Note that the chip itself is powered from the 5V Voc 
e All Surface Mount line required to use present day flash memory devices, 


whereas the inductor is connected to the primary bat- 
tery supply. Voltage spikes may be present in the out- 


Main Features put due to incorrect layout, excessive output filter ca- 
pacitor ESL and diode switching transients. The op- 

e Input Voltage Range: 1.8V to 5.0V tional RC filter circuit is recommended in order to 

© Output Voltage: 12V +4% eliminate these sharp transients. Applications assist- 

© Output Current Capability: Up to 30 mA ance and an evaluation kit is available from Maxim. 

© Typical Efficiency: 87% 

e 170 KHz Operation 

¢ Shutdown Mode On Chip 

© Low Quiescent Current at Shutdown: 45 pA typical 

e Rise Time from shutdown: 25 ms typical 


Table 4-2. Parts List for the MAX732 3V to 12V Converter (30 mA) 


Value/Type | Source 


U1 MAX732CWE SMPS IC Maxim 
(408) 737-7600 
C1, C2 267M1002-336-MR-720 33 wF/10V Matsuo $0.56 
| Tantalum (714) 969-2491 
C3 267M1002-475-MR-720 4.7 wF/10V Matsuo $0.20 
Tantalum (714) 969-2491 
C4 GRM40X7R473M050AD 47 nF Murata Erie $0.08 
(404) 436-1300 
C5, C8 GRM40Z5U104M050AD 0.1 uF Murata Erie 
(404) 436-1300 
C6, C7 267M1602-336-MR-720 33 wF/16V Matsuo $0.62 
Tantalum (714) 969-2491 
R1, R2 9C08052A1ROOJLR 12, 5% Philips $0.04 
(817) 325-7871 
D1 MBRS120T3 Schottky Diode Motorola $0.30 
(800) 521-6274 
L1 CD54-330 33 wH Sumida $0.38 
(708) 956-0666 


Total Cost $4.80 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 
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4.3 Maxim Integrated Products—MAX732: Vpp @ 60 mA 
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Figure 4-3. Maxim MAX732 3V to 12V Converter (60 mA) 


Optimal Attributes 


e Highest Efficiency 
© 60 mA Output Current Capability 


Main Features 


e Input Voltage Range: 1.8V to 5.0V 

© Output Voltage: 12V +4% 

® Output Current Capability: Up to 60 mA 

@ Typical Efficiency: 87% 

e 170 KHz Operation 

e Shutdown Mode On Chip 

© Low Quiescent Current at Shutdown: 45 pA typical 
@ Rise Time from shutdown: 75 ms typical 


The MAX732 circuit as shown here can provide up to 
60 mA at 12V from an input voltage as low as 1.8V. 
This solution is similar to the previous one presented 
but is not entirely surface mountable, because of the 
larger output and input filter capacitors. Currently, it is 
the only solution employing a single IC that can pro- 
vide 60 mA at 12V from a 1.8V input. The 470 wF/16V 
filter capacitor must be a low-ESR (Equivalent Series 
Resistance) type. Voltage spikes may be present in the 
output due to incorrect layout, excessive output filter 
capacitor ESL (Equivalent Series Inductance) and di- 
ode switching transients. The optional RC filter circuit 
is recommended in order to eliminate these sharp tran- 
sients. Applications assistance and an evaluation kit is 
available from Maxim. 
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Table 4-3. Parts List for the MAX732 3V to 12V Converter (60 mA) 


CD75-470 


Value/Type | Source | Cost™ 


U1 MAX732CWE SMPS IC Maxim $2.50 ° 
(408) 737-7600 
C1 267M1002-336-MR-720 33 wF/10V 
Tantalum 
UPR1A151MPH 150 pF/10V 
C3, C7 GRM40Z5U104M050AD 0.1 uF 
C4 267M1002-106-MR-720 10 wF/10V Matsuo $0.21 
Tantalum (714) 969-2491 
C5 GRM40X7R473M050AD 47 nF Murata Erie $0.08 
(404) 436-1300 
C6 UPR1C471MPH 470 wF/16V Nichicon $0.14 
(708) 843-7500 
9C08052A1ROOJLR 10, 5% Philips $0.04 
(817) 325-7871 
D1 MBRS120T3 Schottky Diode Motorola $0.30 
(800) 521-6274 
L1 47 pH Sumida $0.38 
(708) 956-0666 


Total Cost $4.15 


Matsuo 
(714) 969-2491 


Nichicon $0.10 
(708) 843-7500 

Murata Erie $0.12 
(404) 436-1300 | 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 


5.0 Vcc SOLUTIONS: CONVERTING 
UP fee TWO NiCd/ALKALINE 
ELL 


Palmtop and hand-held computers that use two AA 
size NiCd or alkaline batteries need a converter solu- 
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tion to provide the Vcc supply for the system as well as 
flash memory. Two good solutions are offered currently 
for this purpose, the MAX658 from Maxim Integrated 
Products and the LT1110-5 from Linear Technology 
Corporation. 
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5.1 Maxim Integrated Products—MAX658: Vcc @ 250 mA 
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Figure 5-1. Maxim MAX658 3V to 5V Converter (250 mA) 


Optimal Attributes 


@ Highest Efficiency 
@ 250 mA Output Current Capability 
© Low Shutdown Current 


Main Features 


e Input Voltage Range: 2.0V to 3.1V 

© Output Voltage: 5V +10% 

© Output Current Capability: Up to 250 mA 

e Typical Efficiency: 85% 

¢ 18 KHz Operation 

@ Shutdown Mode On Chip 

@ Low Quiescent Current at Shutdown: 80 pA typical 
© Rise Time from shutdown: 25 ms typical 


The MAX658, available from Maxim Integrated Prod- 
ucts in a 14-pin surface mount package, is a good high 
current solution for obtaining Vcc from a pair of 
NiCd/alkaline cells. The entire solution, however, is 
not 100% surface mountable. It uses a high current 
through-hole inductor and a large through-hole filter 
capacitor at the output. Voltage spikes may be present 
in the output due to incorrect layout, excessive output 
filter capacitor ESR (Equivalent Series Resistance) and 
diode switching transients. The optional RC filter cir- 
cuit is recommended in order to eliminate any sharp 
transients. Applications assistance and an evaluation 
kit are available from Maxim. 
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Value/Type | Source 


MAX658 SMPS IC Maxim | 
(408) 737-7600 
UPR1A471MPH 470 wF/10V Nichicon 
. Low Z (708) 843-7500 
267M1602-105-MR-720 1 pF/16V Matsuo $0.15 
Tantalum (714) 969-2491 


C3 GRM40X7R102M050AD 1 nF Murata Erie $0.03 
(404) 436-1300 
C4 GRM40Z5U104M050AD 0.1 pF Murata Erie $0.06 
(404) 436-1300 
9C08052A1ROOJLR 19, 5% Philips $0.04 
? (817) 325-7871 
D1 MBRS120T3 Schottky Diode Motorola $0.30 
(800) 521-6274 
L1 LCM1812R-102K 1.0 mH Inductor Supply Inc. 
Chip Inductor (800) 854-1881 
L2 RCH110-330 33 wH Sumida $0.40 
(708) 956-0666 
U2 MTD3055E NFET Motorola $0.70 
(800) 521-6274 


Total Cost $4.47 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 


5.2 Linear Technology LT1110-5: Vcc @ 150 mA 
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Figure 5-2. Linear Technology LT1110-5 3V to 5V Converter (150 mA) 
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Optimal Attributes © Typical Efficiency: 76% 
© 60 KHz Operation 


e Shutdown Mode Using External Components 
© Low Quiescent Current at Shutdown: 16 wA typical 
© Rise Time from Shutdown: 4 ms typical 


@ Smallest Size 
® Low Shutdown Current 
@ All Surface Mount 


The LT1110-5 from Linear Technology is a fixed 5V 
Main Features version of the converter shown for the 12V design in 


© Input Voltage Range: 2.0V to 3.1V Section 4.1. 
© Output Voltage: SV +5% 
© Output Current Capability: Up to 150 mA 


Table 5-2. Parts List for the LT1110-5 3V to 5V Converter 


Part + Value/Type | Source | Cost® 


LT1110-5CS8 SMPS IC Linear Tech $2.60 
(408) 954-8400 
22 wF/10V Matsuo 
Tantalum Chip (714) 969-2491 
47 pF/16V Matsuo $0.47 
Tantalum Chip (714) 969-2491 
0.1 pF Murata Erie $0.06 
(404) 436-1300 
Schottky Diode Motorola $0.30 
(800) 521-6274 
33 wH Sumida $0.38 
(708) 956-0666 
3K, 5% Philips $0.02 
(817) 325-7871 
10 KO, 5% Philips $0.02 
(817) 325-7871 
12, 5% Philips $0.04 
(817) 325-7871 
PNP Transistor Motorola $0.09 
(800) 521-6274 


Total Cost $4.21 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 
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6.0 DOWN-CONVERTING TO 12V 


The ability to down-convert to 12V from a higher volt- 
age is often needed (as in the telecommunications envi- 
ronment). This section presents some good solutions for 
obtaining Vpp from a higher voltage. 
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6.1 Maxim Integrated Products MAX667 
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Figure 6-1. Maxim MAX667 12V Linear Voltage Regulator 


Output Current Capability: Up to 120 mA 
© Typical Efficiency: 70% 
Shutdown Mode On Chip 


© Low Quiescent Current at Shutdown: 0.2 wA 
Typical 


Optimal Attributes 


@ Small Size 

© Ultra Low Shutdown Current 
@ All Surface Mount ! 

@ Very Low Dropout 


Rise Time from Shutdown: Less than 0.1 ms Typical 


Main Features 


e Input Voltage Range: 12.1V to 16.5V 
© Output Voltage: 12V +5% 


Table 6-1. Parts List for the MAX667 12V Step Down Converter 


Part # Value/Type | Source —|_—Cost* 
U1 MAX667CSA SMPS IC- Maxim 
! SO8 Package (408) 737-7600 
C1 267M1602-476-MR-720 7 pF/16V Matsuo 
Tantalum (714) 969-2491 


R1 9C08053A4023JLR 402 KN, 1% Philips 
(817) 325-7871 


9C08053A4752JLR 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 
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6.2 Linear Technology Corporation LT1111-12 
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Figure 6-2. Linear Technology LT1111-12 Step Down Switcher 


Optimal Attributes 


© High Efficiency 
e All Surface Mount 
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Main Features 


® Input Voltage Range: 16V to 30V 
© Output Voltage: 12V +5% 


© Output Current Capability: Up to 120 mA 
e Typical Efficiency: 80% 


Table 6-2. Parts List for the LT1111-12 12V Step Down Converter 


[Ret | —~—sPart#~=——s«|~SsValue/Type =| Source —«|-—Cost® — 
U1 LT1111-12 SMPS IC- Linear Tech 
SO8 Package (408) 432-1900 
C1 267M3502-225-MR-720 2.2 wF/35V Matsuo $0.28 
Tantalum (714) 969-2491 
C2 267M1602-476-MR-720 47 pF/16V Matsuo $0.47 
| Tantalum (714) 969-2491 


9C08052A1500JLR 1500, 5% Philips $0.02 
(817) 325-7871 

CDR105-470 47 wH Sumida $0.38 
(708) 956-0666 

MBRS140T3 Schottky Diode Motorola $0.60 
(800) 521-6274 


3 Seopa eye 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 
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6.3 National Semiconductor LM2940CT-12 


LM2940CT-12 


* 2 
22 uF/16V 


292092-12 


Figure 6-3. National LM2940CT-12 12V Linear Regulator 


Optimal Attributes The LM2940CT-12 is a low drop-out linear regulator 
from National Semiconductor. This is a good low cost 
@ Lowest Cost fixed 12V output solution. The part is offered in a stan- 


dard TO-220 plastic package. The input capacitor is 
required only if the regulator is located far away from 
the input power supply filter, and the output capacitor 
must be at least 22 wF in order to maintain stability. 


Main Features 


© Input Voltage Range: 13V to 26V 
© Output Voltage: 12V +3% 
© Output Current Capability: 1A 


Table 6-3. Parts List for the LM2940CT-12 Step Down Converter 


Value/Type | Source. | Cost* 


Voltage Reg TO-220 National 
(408) 721-5000 
0.47 wF/50V Murata Erie 
(404) 436-1300 


*Cost estimates based on published 10K unit pricing at the time this application note was written. 
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7.0 OBTAINING Vpp FROM 12V 
UNREGULATED 


In systems like the desktop computer, a 12V supply 
exists but may not be regulated to + 5%. If this voltage 
is used as the Vpp source for flash memory, it may well 
degrade the write/erase performance of the memory, or 
adversely affect its reliability. Fortunately, in most of 
the situations where a 12V unregulated (or not regulat- 
ed to within 5%) supply exists, a 5V supply also exists 
in the system (the desktop computer is a good exam- 
ple). It is recommended in such cases that the existing 
5V supply be used to obtain the 12V +5% rail. This 
approach is more economical, more efficient, and pro- 
vides space savings over a buck-boost topology that 
takes unregulated 12V and regulates it to + 5%. 


In the rare case where a S5V supply is not present, mod- 
ular solutions exist that will regulate the unregulated 
12V supply to +5%. However, these are bulky and 
expensive. Moreover, many of them require that a mini- 
mum load be maintained in order to stay in regulation. 
One such solution in presented in Appendix A. 


AP-357 


8.0 SUMMARY 


For battery powered applications, the author views the 
discrete switching regulator IC solution as a better 
choice than the modular solution. The lower cost, high- 
er efficiency, and smaller size/height associated with 
discrete solutions justify the small additional design ef- 
fort required to incorporate them in flash memory ap- 
plications. In applications where the primary source of 
power is a wall power outlet, or in applications where 
the flash memory will be written to infrequently, effi- 
ciency and quiescent current take on secondary impor- 
tance. In such cases, it may be acceptable to use a 12V 
regulated (to within +5%) tap from the system supply. 
Alternatively, the ability to easily design-in modular so- 
lutions may outweigh the disadvantages of lower effi- 
ciency and increased cost. For those users wishing to 
incorporate modular solutions, Appendix A provides 
some of the lower cost solutions from this industry seg- 
ment. 
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APPENDIX A 
MODULAR SOLUTIONS 


Modular solutions may work well in non-battery pow- 
ered situations where the efficiency of the power supply 
converter is not critical. These are also advantageous in 
that they usually do not need any external components 
and there is no converter design involved. However, the 
type and quality of the discrete components used in 
these hybrid solutions is open to question. This is not 
true in the case of the discrete converter designs pre- 
sented in the earlier sections, where the quality of the 
components used are under the control of the system 
design engineer. Hence, even though modular solutions 
offer the convenience of a single package and ease of 
testability, the quality/reliability of comparably priced 
modular solutions may be questionable. 


Some modular solutions suited to flash memory appli- 
cations are presented below, with a brief description of 
each. Sources for obtaining these are listed in Appendix 
B. 


A.1 International Power/Newport 
Components NMF0512S 


The NMFO0512S is a 5V to 12V hybrid power module 
that has an output current capability of 80 mA. Output 
tolerance is +5%. It is equipped with a shutdown pin 
which can be used to switch Vpp off. However, power 
dissipated in the shutdown mode is relatively high 
(about 100 mW). The part is small in size and measures 
0.76 in. (19.5 mm) x 0.4 in. (9.8 mm) x 0.4 in. (9.8 mm), 
and costs about $7.90 in 10K quantities (at the time 
this application note was written). Typical efficiency of 
conversion is 62%. 
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A.2 Xentek NPSC-0512S 


The Xentek NPSC-0512S is a 1W power module that 
converts 5V to Vpp and will source up to 80 mA of 
continuous current. However, it uses two external filter 
capacitors—one at the input and one at the output. The 
input filter capacitor is 47 ~F/10V, and the output fil- 
ter capacitor is 100 wF/16V. Size of the solution (con- 
verter alone) is 0.87 in. (22 mm) x 0.39 in. (10 mm) x 
0.79 in. (20 mm). The NPSC-0512S does not have a 
shutdown mode. The part costs around $5.00 in 10K 
quantities (at the time this application note was writ- 
ten). Typical efficiency of conversion is 60%. 


A.3 Shindengen America Inc. 
HDF-0512D 


The HDF-0512D module from Shindengen will convert 
unregulated 12V to 12V +5%. This part is a dual out- 
put part (+ 12V), but only the + 12V line is used. The 
conversion efficiency is high (75% typical), and the 
part will provide a regulated Vpp voltage from input 
voltages as low as 8V, and as high as 16.5V. A mini- 
mum load of 5 mA needs to be maintained to guarantee 
regulation. Size of the solution is 1.75 in. (44 mm) x 
0.43 in. (11 mm) x 0.8 in. (20 mm). Cost is approxi- 
mately $10.00 in quantities of 10K (at the time this 
application note was written). 
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NOTES: 


1. # External components. D: Diode, L: Inductor, C: Capacitor, R: Resistor, T: Transistor. 

2. Cost. Cost estimates assume 10K quantities, based on published pricing at the time this application note was written. 

3. PC Area. PC Aarea is conservatively estimated as 2.0x (area of all components). Where actural layouts are presented, the lower value is given. Note 
that this estimate is for a single sided board, and area can be reduced considerably if both sides of the board are utilized. 

4. | Shdn. Current consumed by supply at shutdown. Output settles to Vcc at shutdown, so some additional flash Vpp leakage/standby will exist. 

5. R Time. Rise time from shutdown state. Erase/Writes should not be attempted till Vpp level has risen to valid level after shutdown is disabled. 
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APPENDIX C 


SOURCES/CONTACTS FOR RECOMMENDED 
DC-DC CONVERTERS 


Linear Technology Corporation 


Recommended Products: 

— LT1110-12 (DC-DC Converter IC) 
— LT1110-5 (DC-DC Converter IC) 
— LT1109-12 (DC-DC Converter IC) 
— LT1111-12 (DC-DC Converter IC) 


In U.S.A.: 

1630 McCarthy Blvd. 
Milpitas, CA 95035-7487 
Tel: (408) 432-1900 

Fax: (408) 432-0507 


In Europe (U.K.): 

111 Windmill Road 
Sunbury 

Middlesex TW16 7EF 
U.K. 

Tel (44)(932) 765688 
Fax (44)(932) 781936 


In Asia (Japan): 

4F Ichihashi Bldg 

1-8-4 Kudankita Chiyoda-ku 
Tokyo 102 Japan 

Tel (81) (03) 3237-7891 

Fax (81) (03) 3237-8010 


Maxim Integrated Products 


Recommended Products: 

— MAX732 (DC-DC Converter IC) 
— MAX658 (DC-DC Converter IC) 
— MAX667 (DC-DC Converter IC) 


In U.S.A.: 

120 San Gabriel Drive 
Sunnyvale, CA 94086 
Tel (408) 737-7600 
Fax (408) 737-7194 
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In Europe (U.K.): 
Maxim Integrated Products (UK), Ltd. 
Tel: (44) (734) 845255 


In Asia (Japan): 
Maxim Japan Co., Ltd. 
Tel: 81 (03) 3232-6141 


Motorola Semiconductor Inc. 


Recommended Product: 
— MC34063AD (DC-DC Converter IC) 


In U.S.A.: 

616 West 24th Street 
Tempe, AZ 85282 
Tel: (800) 521-6274 


In Europe (U.K.): 
Tel: (44) (296) 395-252 


In Asia (Japan): 
Tel: (81) (3) 440-3311 


National Semiconductor 


Recommended Product: 
— LM2940CT-12 (Voltage Regulator IC) 


In the U.S.: | 

2900 Semiconductor Drive 
P.O. Box 58090 

Santa Clara, CA 95052 
Tel: (408) 721-5000 


In Europe: 

National Semiconductor (UK) Ltd. 
The Maple, Kembrey Park 
Swindon, Wiltshire SN26UT 

U.K. 

Tel: (07-93) 614141 

Fax: (07-93) 697522 
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In Asia: 

National Semiconductor Japan Ltd. 
Sanseido Bldg. 5F 

4-15 Nishi Shinjuku 

Shinjuku-ku 

Tokyo 160 Japan 

Tel: (81) (3) 299-7001 

Fax: (81) (3) 299-7000 


Newport Components/ 
international Power 


Recommended Product: 
— NMF0512S (5V-12V Converter Module) 


In U.S.A.: 

International Power Sources 
200 Butterfield Drive 
Ashland, MA 01721 

Tel: (508) 881-7434 

Fax: (508) 879-8669 


In Europe: 

Newport Components 

4 Tanners Drive 
Blakelands North 

Milton Keynes MK 14 5NA 
Tel: (0908) 615232 

Fax: (0908) 617545 


Shindengen Electric Co. Ltd. 


Recommended Product: 


— HDF0512D (12V unreg. to 12V reg. converter 


module) 


In the U.S.: 

2649 Townsgate Road #200 
Westlake Village, CA 91361 
Tel: (800) 634-3654 

Fax: (805) 373-3710 
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In Europe: 

Shindengen Magnaquest U.K. Ltd. 
Unit 13, River Road, 

Barking Business Park, 

33 River Road, Barking, 

Essex 1G11 ODA 

Tel: (44) (81) 591-8703 

Fax: (44) (81) 591-8792 


In Asia: 

2-1,2-Chome Ohtemachi 
Chiyoda-ku 

Tokyo 100 

Japan 

Tel: (81) (3) 279-4431 
Fax: (81) (3) 279-6478 


Xentek Inc. 


Recommended Product: 
— NPSC0512S (SV-—12V Converter Module) 


In U.S.A.: 

760 Shadowridge Drive 
Vista, CA 92083 

Tel: (619) 727-0940 
Fax: (619) 727-8926 


In Europe (Germany): 
Xentek, Inc. 

c/o Taiyo Yuden GMBH. 
Obermaierstrasse 10, 

D-8500 Nurnberg 10 

Federal Republic of Germany 
Tel: (49) (911) 350-8400 

Fax: (49) (911) 350-8460 


In Asia (Japan): 
Xentek, Inc, 

c/o Taiyo Yuden., Ltd. 
6-16-20, Ueno, Taito-ku 
Tokyo 110 

Japan 

Tel: (81) (3) 3837-6547 
Fax: (81) (3) 3835-4752 
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APPENDIX D 
CONTACTS FOR DISCRETE COMPONENTS 


Matsuo Electric Co., Ltd. 


Matsuo’s 267 series surface mount tantalum chip ca- 
pacitors are recommended by Maxim and Linear Tech- 
nology for input and output filter capacitors on their 
DC-DC converters. Part #s are included on the parts 
list that accompanies most solutions. If alternate 
“equivalents” are required, choose high reliability, low 
ESR (Equivalent Series Resistance) and low ESL 
(Equivalent Series Inductance) type tantalums, which 
help in keeping output ripple and switching noise to a 
minimum. 


In US.A.: 

2134 Main St., Ste. 200 
Huntington Beach , CA 92648 
Tel: (714) 969-2491 

Fax: (714) 960-6492 


In Europe: 

Steucon - Center II Mergenthalleralle 77 
D-6236 Eschben/Ts. 

Federal Republic of Germany 

Tel: 6196-470-361 

Fax: 6196-470-360 


In Asia: 

Oak Esaka Bldg. 
10-28 Hiroshiba-Cho 
Suita-shi 

Osaka 564 

Tel: (06) 337-6450 
Fax: (06) 337-6456 


Sumida Electric Co. Ltd. 


Sumida CD series surface mount inductors are recom- 
mended by Maxim, Linear Technology for their minia- 
ture size and relatively low cost. These are well suited 
to low power DC-DC converter applications. Contact 
Sumida Electric directly for procuring these. The part 
#s are included in the parts list that accompanies most 
solutions. In applications where noise (EMI) is a con- 
cern, shielded varieties are also offered by Sumida. 
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In U.S.A: 

637 East Golf Road 

Suite 209 

Arlington Heights, IL 60005 
Tel: (708) 956-0666 

Fax: (708) 956-0702 


In Asia: 

4-8 Kanamachi 2-chome, 
Katsushika-ku, 

Tokyo 125 

Japan 

Tel: (81) (03) 3607-5111 

Fax: (81) (03) 3607-5428 


Coiltronix Inc. 


Coiltronix is recommended as a good alternate source 
for surface mount inductors. The CTX series offered by 
Coiltronix is well suited to DC-DC converter applica- 
tions. These are shielded, and have a toroidal core. 
However, they are bigger in size and currently much 
more expensive (7X to 8X) than the Sumida varieties 
recommended in the solutions herein. The equivalent 
part numbers are: 


Sumida CD54-470 —> Coiltronix CTX50-1 
Sumida CD54-180 —> Coiltronix CTX20-1 
Sumida CD54-220 — Coiltronix CTX20-1 
Sumida CD75-470 — Coiltronix CTX50-2 
Sumida CDR105-470 — Coiltronix CTX50-2 


In U.S.A.: 

Coiltronix Inc. 

984 S.W. 13th Court 
Pompano Beach, FL 33069 
Tel: (305) 781-8900 


Fax: (305) 782-4163 


In U.K.: 

Microelectronics Technology Ltd. 
Great Haseley Trading Estate 
Great Haseley 

Oxfordshire OX9 7PF 

U.K. 

Tel: (08) 44 278781 

Fax: (08) 44 278746 
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In Asia: 

Serial System Mktg. 
Poh Leng Bidg., #02-01 
21 Moonstone Lane 
Singapore 1232 


Tel: 2938830 
Fax: 2912673 


Coilcraft 


Coilcraft is also recommended as a good alternate 
source for surface mount inductors. The N2724-A 
shielded series is well suited to DC-DC converter appli- 
cations. These are bigger and currently more expensive 
(2x to 3x) than the Sumida inductors recommended in 
the solutions. Contact Coilcraft directly for any appli- 
cations assistance or for procurement of these parts. 
The equivalent part numbers are: 


Sumida CD54-470 —> Coilcraft N2724-A 47 »H 
Sumida CD54-180 —> Coilcraft N2724-A 18 wH 
Sumida CDR105-470 — Coilcraft N2724-A 47 wH 


In the US: 

1102 Silver Lake Road 
Cary , IL 60013 7 
Tel: (708) 639-6400 
Fax: (708) 639-1469 


In Europe: 

21 Napier Place 
Wardpark North 
Cumbernauld 
Scotland G68 OLL 
Tel: 0236 730595 
Fax: 0236 730627 


In Asia: 

Block 101, Boon Keng Road 
#06-13/20 

Kallang Basin Industrial Estate 
Singapore 1233 

Tel: 2966933 

Fax: 2964463 


Philips Components 


Philips Components is recommended as a good source 
for surface mount (SMD) resistors (standard 9C series, 
and 9B (MELF) series). Part #s are included in the 
parts list that accompanies most of the solutions in the 
application note. Many alternate sources exist. 


In the US: 

2001 W. Blue Heron Blvd. 
P.O. Box 10330 

Riviera Beach, FL 33404 
Tel: (407) 881-3200 
Fax: (407) 881-3304 
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In Europe: 

Philips Components Ltd. 
Mullard House 
Torrington Place 
London WCIE 7HD 
Tel: (44) 71 580 6633 
Fax: (44) 71 636 0394 


In Asia: 

Philips K.K. 

Philips Bldg. 13-37 
Kohnan 2-chome 
Minato-Ku Tokyo 108 
Tel: (81) 3 740-5028 
Fax: (81) 3 740-5035 


Siliconix-Logic Level PFETs 


Siliconix offers low-”on” resistance logic level PFETs 
(Si9400, and Si9405) that can be used for switching a 
DC-DC converter into a shutdown state by using these 
switches on the high side of the input to the converter 
(see Appendix E). 


In the US: 

2201 Laurelwood Road 
P.O. Box 54951 

Santa Clara, CA 95056-9951 
Tel: (408) 988-8000 

Fax: (408) 727-5414 


In Europe: 

Weir House 

Overbridge Square, Hambridge Lane 
Newbury, Berks RG14 5UX 

Tel: (0635) 30905 

Fax: (0635) 34805 


In Asia: 

Room 709, Chinachem Golden Plaza 
77 Mody Road 

TST East Kowloon 

Tel: (852) 724-3377 

Fax: (852) 311-7909 
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APPENDIX E 
OTHER DESIGN CONSIDERATIONS 


E.1 Vpp Valid Handshake Logic 


It is often desirable to have, along with the Vpp solu- 
tion, a handshake signal (using extra hardware) that is 
asserted as long as the voltage level on Vpp is valid. 
The following schematic illustrates a good way of 
achieving this. This handshake signal could be used to 
determine when it is suitable to perform writes/erases 
on the flash device. The circuit shown uses a precision 
zener voltage reference and a comparator, along with 
bias resistors, to monitor the voltage level on Vpp. The 
point at which the comparator trips must be set after 
careful consideration of the variation in the reference 
voltage and the tolerances on the bias resistors. The 
worst case conditions on these variations must guaran- 
tee that the handshake signal is asserted when Vpp is at 
its worst case lower-end level (11.4V). Care must be 


taken to use the exact same components as specified in - 


order to maintain the tight tolerance on the trip level of 
the output signal. 


E.2 Obtaining Shutdown Using Logic 
Level PFETs 


Low “on” resistance logic level PFETs can be used on 
the high side of the input to the DC-DC converters to 
obtain shutdown. One such part is the $i9405 from Sili- 
conix Inc. The device is part of the “little foot” series, 
and is available in an SO8 (8-pin surface mount) pack- 
age. The Si9405 is a logic level PFET with an “on re- 


Ri 
107k, 0.1% 


R2 
12.4k, 0.1% 


sistance” of 0.22 (at a gate drive of 4.5V). It is impor- 
tant to have as low an “on” resistance as possible, since 
the peak currents and start-up currents into the supply 
are high. Care must be taken to ensure that the DC-DC 
conversion process is not affected after accounting for 
the drop in input voltage across the PFET. 


E.3 Working of the Discrete Step Up 
Switching Regulator 


This section presents a brief overview of the operation 
of discrete step up switching regulators, and presents 
issues that the user needs to be concerned with while 
designing these solutions into the system. 


The four most basic elements of a discrete switching 

regulator power supply are: : 

1. The SMPS IC (which includes the switch control 
element and logic, along with the power switch it- 
self), 


2. An inductor for storage and transfer of energy be- 
tween the input and output, 


3. A switching diode to direct the inductor energy to 
“catch”, or channel, the inductor energy to the out- 
put, and 


4. An output filter capacitor. 


Vpp VALID# 


—_——Ss D 1: LINEAR TECHNOLOGY CORP LT1004~-1.2 
U1:LINEAR RECHNOLOGY CORP LT1017CN8 
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Figure E-1. Vpp Valid Handshake Circuit 
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In the boost configuration where the output voltage is 


greater than the input voltage, the basic switching pow- 
er supply configuration is as shown in Figure E.2: 
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Figure E-2. Working of the Step-Up 
Switching Regulator 


The power switch SW can be turned on and off; the 
control for it is derived from a feedback mechanism 
that senses the output voltage. While the switch is 
turned on, the inductor stores energy as the current 
flows through it from the input supply. The peak cur- 
rent through the inductor I; can be approximated as 
(VIN/L * ton); where ton is the on time of the switch. 
During this time, the energy is supplied by the input 
voltage, Vi = Vjn. The output is isolated from the 
inductor via the reverse-biased diode, and the load cur- 
rent is supplied by the output filter capacitor. When the 
switch turns off, the energy stored in the inductor ap- 
pears as a rapidly increasing voltage across the induc- 
tor. As soon as this voltage reaches a value equal to the 
output voltage plus the voltage drop across the diode, 
the diode switches on and current starts to flow 
through the diode. This diode current supplies the load 
current while also at the same time charging up the 
output filter capacitor to the output voltage. 


The switch is controlled by sensing the output voltage 
via a feedback mechanism—usually a pair of resistors. 
This sense voltage is gated via a comparator whose out- 
put acts as a control signal to an oscillator. The oscilla- 
tor output controls the switch. 


The power into the inductor Py can be approximated 
as: 


P, = 0.5* L * Ipx2 * fosc 


and the power into the load PLoap (out of the induc- 
tor) can be approximated as 


PLoab = (Vout + Vp — Vin) * lout 
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The peak currents through the inductor is usually sev- 
eral times higher than the load current, is mostly of the 
value of the load current and builds up during time 
ton. On most of the solutions presented here, peak op- 
erating currents lie in the range of 500 mA to 1.2A. 
Though this may seem high, most of this in-rush of 
energy is transferred to the output, and little is lost to 
heat due to the efficient energy storage characteristic of 
inductors. Note that since the peak currents are high, 
the input voltage source must be capable of provid- 
ing this current, and the current capability of the 
input source must not be calculated simply as 
(Vout * Iout)/(VIn * Eff). A large bypass capacitor 
at the input pin of the converter is hence also necessary 
on all designs. 


Some of the solutions presented in this application note 
are of the fixed duty cycle or fixed on time type (e.g. 
LT1110-12, LT1109-12, MC34063A), whereas some of 
them vary the duty cycle depending on the load current 
(e.g. MAX732, MAX658). These latter ones provide 
higher efficiencies. 


Inductor Selection 


The choice of an inductor is crucial to the design of the 
power supply system. To begin with, the inductor value 
must be low enough to supply the peak currents needed 
when the input voltage V{n, as well as the on time toy, 
are at their worst case low value. On the other hand, 
the inductor value must be high enough so that the 
peak currents at the worst case high values do not ex- 
ceed the maximum peak currents that can be handled 
by the switch. Furthermore, once the value has been 


picked, the physical inductor that is chosen for the job 


must be able to handle these peak currents, and must 
not saturate. This is done by picking an inductor whose 
DC current rating is more than the worst case peak 
current that will be required by the operation of the 
device. The other characteristic to consider is the resist- 
ance of the inductor. In order to keep losses to a mini- 
mum, it is essential that the resistance of the coil is a 
minimum. Thus, it is important to use the inductors 
specified in the parts list that accompanies the solu- 
tions. These have been carefully chosen after reviewing 
the requirements. Alternate inductors may be used, as 
long as they are “equivalent”’. 


EMi Concerns 


Since the switching regulators presented in this applica- 
tion note switch at frequencies between 60 KHz and 
200 KHz, there exists a potential for EMI. In cases 
where EMI may be a problem, shielded inductors can 
be used. This will reduce EMI significantly. Shielded 
versions of the inductors specified are readily available. 
Contact the vendor directly for these. 


2-37 


2 


AP-357 


Output Switching Noise 


Output switching noise has several sources. The most 
significant one is the IR drop through the ESR (Equiv- 
alent Series Resistance) of the output filter capacitor. 
This is caused by switching current pulses from the 
inductor. There is also noise in the form of switching 
spikes riding on the DC output. This is due to the out- 
put filter capacitor’s ESL (Equivalent Series Induc- 
tance), current spikes in the ground trace and rectifier 
turn-on transients. 


It is important to use low ESR and low ESL output and 
input filter capacitors. Proper layout is also essential in 
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order to avoid spikes in the output. The safest solution 
is to use a filter circuit at the output. LC filters are not 
recommended, because of the transient nature of the 
load currents on flash devices. An RC filter is recom- 
mended on most solutions as an option. Two 12 resis- 
tors are used in parallel to avoid causing a significant 
drop across the resistance. This method is inexpensive 
and assures that the spikes riding on the output wave- 
form are contained to within the 5% tolerance require- 
ment on Vpp. 


In addition, care must be taken to keep the leads from 
the output of the solution to all flash devices as short as 
possible. Use of a 0.1 wF capacitor at the Vpp pin of 
each flash device is highly recommended. 
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APPENDIX F 
PC LAYOUTS FOR SOME RECOMMENDED SOLUTIONS 


F.1 Maxim Integrated Products 
MAX732 


The double-sided layout presented below (Figure F-1) 
has been designed for the MAX732 5V-12V converter 
solution (Section 3.1). It is a double sided layout and 
has been designed for the parts specified in the parts list 
that accompanies the solution. Contact Maxim for any 
additional layout assistance. 


F.2 Linear Technology Corporation 


LT1110-12 


The single-sided layout presented below (Figure F-2) 
can be used to implement the LT1110-12 5V to 12V 


Surface Mount Drilling Guide (1X Scale) 
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(1X Scale Top Side Trace View) 
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converter (Section 3.2), the LT1110-12 3V—12V con- 
verter (Section 4.1), or the LT1110-5 3V to 5V convert- 
er (Section 5.2). The layout has been designed for the 
parts that are specified in the parts list that accompa- 
nies these solutions. Contact Linear Technology for any 
additional layout assistance. 


F.3 Linear Technology Corporation 
LT1109-12 


The single-sided layout presented below (Figure F-3) 
can be used to implement the LT1109-12 5V—12V con- 
verter solution (Section 3.3). The layout has been de- 
signed for the parts that are specified in the parts list 
that accompanies the solution. Contact Linear Tech- 
nology for any additional layout assistance. 


(Component Placement Diagram) 
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(1X Scale Bottom Side Trace View) 
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Figure F-1 
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(2X Scale Trace View) 
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(1X Scale Trace View) (1X Scale Component Placement Diagram) 
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Figure F-2 
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(2X Scale Trace View) | (2X Scale Component Placement Diagram) 
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(1X Scale Trace View) (1X Scale Component Placement Diagram) 
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Figure F-3 
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1.0 INTRODUCTION 


Flash memory’s combination of nonvolatility and easy 
in-system updateability are key attributes driving its 
adoption into today’s system designs. However, this 
flexibility also brings with it the responsibility (for 
hardware and software engineers) to ensure that writes 
to flash memory occur only when intended. This is espe- 
cially important for those who are accustomed to de- 
signing with various ROM (nonvolatile but non-up- 
dateable) and RAM (updateable but volatile) memo- 
ries. 


This application note discusses techniques for proac- 
tively designing systems to prevent unintentional writes 
to flash memory. These design techniques are by no 
means complex or costly, but their implementation is 
crucial to ensuring reliable operation through system 
lifetime. For more information on the devices and spec- 
ifications discussed in this document, please consult 
specific flash memory datasheets. 


2.0 WHY IS WRITE PROTECTION 
IMPORTANT? 


Let’s begin by identifying the key characteristics of two 
generic memory technologies: ROM (Read-Only-Mem- 
ory) and RAM (Random-Access-Memory). Flash 
memory combines many of the capabilities of both in 
one solution. Therefore, it is often being utilized to re- 
place ROM and/or RAM in new designs. At a mini- 
mum, flash memory’s status as a relatively new tech- 
nology means that many engineers are moving to it 
from the familiarity of a ROM/RAM knowledge base. 


RAM is fully alterable on a bit-by-bit basis, and the 
mechanism for writing to it is established and well un- 
derstood. RAM is in-system updateable, yet it is vola- 
tile. This means that when a RAM memory loses pow- 
er, it also loses its data. RAM is guaranteed not to 
contain valid information on powerup. 


ROM offers the advantage of nonvolatility, i.e. when 
power is removed from the device, the information 
stored inside is retained. However, ROM is not in-sys- 
tem updateable. Once the information is initially put 
into the device, it is permanent and unchangeable. To 
replace the information, you have to physically re- 
move/replace the device itself. 


Traditional system memory architectures often includ- 
ed both ROM (nonvolatile but non-updateable) and 
RAM (volatile but in-system updateable). The new 
model for system design retains some RAM for tempo- 
rary data storage, but replaces the rest of RAM and 
ROM with flash memory. Being both nonvolatile and 
in-system updateable, flash memory encompasses the 
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strengths of both RAM and ROM, offering new system 
architecture possibilities. However, whereas in the past 
RAM was guaranteed to be invalid on system powerup 


and ROM was guaranteed to be unalterable, the same 
cannot be said for flash memory. 
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Any alteration of flash memory contents (whether 
planned or unintended) is permanent regardless of sys- 
tem power transitions, until the data is again modified. 
As we’ll see later, command writes to flash memory can 
also put it in modes where it outputs something other 
than array data, a non-permanent but still undesirable 
condition when not intended. This means that the sys- 
tem hardware and software must ensure that flash 
memory is written only when specifically desired, to 
ensure a predictable system environment. The following 
sections will discuss how this can be accomplished. 


3.0 SYSTEM WRITES WITH BULK- 
ERASE FLASH MEMORIES 


First-generation bulk erase flash memories from Intel 
Corporation are shown in Figure 1. These devices auto- 
matically power up in a “Read Array”’ mode in which 
they output array data when read. Transitions to alter- 
nate modes occur by writing commands to the flash 
memory. 


a ae 
128 Kbytes (x8) 


Figure 1. Intel Corporation 
Bulk-Erase Flash Memories 


Bulk-erase flash memories include several forms of 
“protection” to guard against unintended writes. 
Writes with Vpp (the program/erase voltage) at Vpp; 
(OV to 6.5V) are disregarded by the flash memory. Sim- 
ilarly, write attempts with Vcc at or below Vi Ko 
(2.5V on most devices) are ignored. Finally, these de- 
vices require multi-byte command sequences to initiate 
internal program or erase algorithms. Note, however, 
that while the erase command sequence (shown in Fig- 
ure 2) requires both the proper Erase Setup and Erase 
Confirm commands, the program sequence (Figure 3) 
relies only on the valid Program Setup command. The 
second command in the latter sequence can have any 
value, and is interpreted as data to be programmed. 
This means that if the flash memory receives an unin- 
tended Program Setup command, the very next write to 
the device (intended or not) will be interpreted as pro- 
gram data and initiate an internal program event (if 
Vpp is above Vpprz). 


Erase Setup : 
(20H) : 


Erase Confirm 


(20H for Bulk-Erase, 
DOH for Block—Erase) 


oe 
a 
SOO RD 
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Figure 2. Flash Memory Erase 
Command Sequence (Simplified) 


Beyond the program and erase sequences, the Read In- 
telligent Identifier Codes command will, when written 
to the flash memory, put it in a mode where it outputs 
device signature IDs instead of array information when 
read. 


Program Setup 


(40H for Bulk-Erase, 
40H/10H for Block-Erase) s 


Program Data : 
(xxH) 


BRRRRRRRRRRRRRRRR 


Programming 
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Figure 3. Flash Memory Programming 
Command Sequence (Simplified) 


4.0 SYSTEM WRITES WITH BOOT 
BLOCK AND FlashFile™ 
MEMORIES 


Second-generation block-erase Boot Block and Flash- 
File memories from Intel Corporation are shown in 
Figure 4. They function similarly to the bulk-erase de- 
vices described earlier, with a few key enhancements. 
As before, these devices automatically power up in 
“Read Array” mode, and transition to alternate modes 
via command writes. 
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BOOT BLOCK ARCHITECTURE 
Density 


Figure 4. Intel Corporation 
Block-Erase Flash Memories 


28F001BX 
28F200BX 
 28F002BX 


For full access to the flash memory Status Register, as 
well as for enhanced interface to internal device identi- 
fiers, these block-erase flash memories will accept com- 
mands written to them regardless of Vpp voltage, as 
long as Vcc is above Vi Ko. Program and erase algo- 
rithms initiated by command sequences will terminate 
with Status Register error indication and unaltered ar- 
ray data, if Vpp is at Vppy.. However, regardless of Vpp 
level, the device will still transition to a “Read Status 
Register” mode after program/erase command se- 
quences are written. In this case, it will output data that 
the system, if the write was unintended, will not expect. 
The same multi-byte command sequences (shown in 
Figures 2 and 3) are used as in bulk-erase flash memo- 
ries. 


Boot Block and FlashFile memories provide commands 
(in addition to the program and erase sequences) which 
transition the memory to alternate modes, outputting 
data other than array information for subsequent reads. 
In this respect, they are similar to bulk-erase flash 
memory discussed earlier. These commands are Intelli- 
gent Identifier and Read Status Register. 


Block-erase devices include a hardware input. called 
RP# (or Reset/Powerdown). Among its many uses, 
this pin acts as a “master on/off switch” to completely 
disable the flash memory and lock all other control in- 
puts. RP# is extremely effective at blocking unintend- 
ed writes during system power transitions. This tech- 
nique will be covered in detail, in a few paragraphs. 


5.0 PREVENTING UNINTENDED 
WRITES DURING NORMAL 
SYSTEM OPERATION 


Preventing unintended writes to flash memory during 
normal system operation is a routine part of debugging 
a new design, and a common concern for any “writea- 
ble” device on the processor interface. Any combina- 
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tion of active chip select (CE#) and active write enable 
(WE#) has the potential of being decoded by the flash 
memory as a valid write attempt. One common culprit 
in these situations is the chip select decoder logic (PAL, 
etc.) between the processor and external devices. As 
addresses propogate through this logic at the beginning 
of an access cycle, or in the undefined address state 
between accesses, spurious chip selects of indeterminate 
duration can be generated. System hardware should en- 
sure that at these times, WE# to flash memory stays at 
a logic “1” and doesn’t transition low. 


Some concern has also been expressed in the past about 
unintended writes in certain “open” systems such as 
the personal computer. In these environments, the type 
and function of software run on the machine is beyond 
the control of the computer manufacturer, who must 
accordingly design his/her hardware. For example, a 
third-party software utility may write to flash memory 
assuming DRAM at that location. More malicious, of 
course, is the case of the computer virus. Fortunately, 
in cases like this, hardware design to prevent unintend- 
ed writes is fairly simple. 


WR# (FROM SYSTEM) , 
WE# (TO FLASH 
GPIO MEMORY) 
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Figure 5. WE# Gating 


Figure 5 shows one means of clarifying the WE# sig- 
nal. When flash memory is used for BIOS storage, for 
example, the manufacturer’s update utility ts the only 
software that should be writing to the device. By tog- 
gling the general purpose I/O line (whose default state 
is, of course, “disabled’’), the update utility can control 
whether writes from the system are blocked or allowed 
to pass to the flash memory. This type of WE clarify- 
ing function is integrated in the Intel386™MSL and In- 
tel486TMSL Microprocessor Supersets. ASICs integrat- 
ing motherboard functions should also be designed to 
include such logic. 


One other method for preventing flash memory altera- 
tion is by controlling (or “switching” the Vpp voltage, 
turning it on to Vppy only when desired for system 
update. Many 12V converters and power supplies inte- 
grate this on/off function as shown in Figure 6, or it 
can be provided by an external FET. This approach 
will be used again in the next section on write protec- 
tion during system power transitions. Note, however, 
that although it prevents actual flash memory data al- 
teration, Vpp control is insufficient to keep block-erase 
flash memories from transitioning to alternate data out- 
put modes by unintended writes. 
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Figure 6. Vpp 12V Converter with 
Integrated Switch (Example) 


In a traditional “closed” system, the software directing 
the hardware is totally under control of the system 
manufacturer. No additional effort should be needed 
(after the initial prototype hardware and software de- 
bugging) to protect the flash memory from unintended 
writes during normal system operation. Write control 
during system powerup and powerdown also requires 
attention, however; a topic covered next. 


6.0 PREVENTING UNINTENDED 
WRITES DURING SYSTEM 
RESET AND POWERUP/ 
POWERDOWN 


System powerup and/or powerdown offer the greatest 
potential for unintended writes in flash memory-based 
system designs. As mentioned earlier, similar potential 
also exists for other “nonvolatile/rewriteable’’ memory 
technologies, such as EEPROM and battery-backed 
SRAM. Several reasons for this are listed below. 


@ When a system begins to power up, all logic outputs 
_ are at OV. This is also the “enable” condition for 
flash memory CE# and WE# inputs. 


© Logic devices have specified, documented and guar- 
anteed operation only at a specific supply voltage 
range (typically SV + 10% or 3.3V +0.3V). Opera- 

- tion beyond this voltage range is not guaranteed and 
may not be consistent. Specifically, device output 
behaviour is typically undefined. 


e Similarly, logic operation is sometimes undefined 
and erratic when devices are being reset. For exam- 
ple, MCS-186 embedded processors, when reset, tri- 
state their WR# (write enable) outputs, which will 
then typically drift toward OV (or “enabled’’, to 
TTL inputs). 
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Figure 7. Basic Processor/Flash Memory Interface 


e If both the Vcc and Vpp power supplies are 
switched “on” at the same time, one or the other is 
likely to ramp to a “valid” level first, depending on 
the relative capacitive loading at the supply outputs. 
Similarly, one supply will often ramp below its valid 
voltage range before the other, on system poweroff. 
This situation is acceptable, as long as the WE# 
and/or CE# signals to the flash memory are con- 
trolled. 


Figure 7 shows a very basic example processor/memo- 
ry interface. When the system power is switched on, the 
processor (or logic) WE# output and logic CE# out- 
put are both at GND. Depending on the processor and 
logic, these outputs may not reliably stabilize until Voc 
ramps to 4.5V. In most cases, CPU and’ logic outputs 
will smoothly follow the supply voltage up to operating 
levels. Any oscillations on these outputs, however, can 
be decoded as a valid write by the flash memory, which 
begins to “wake up” below 4.5V Vcc. Similarly, ad- 
dress and data processor outputs are typically unde- 
fined below operating voltage ranges. Given a x8 inter- 
face between processor and flash memory (therefore, 
with 256 possible combinations of data inputs), there is 
a finite chance that a valid command byte will be ran- 
domly generated and written to the flash memory. 


If the Vpp power supply output is less capacitively 
loaded than Vcc, Vpp can ramp above Vppy before 
Vcc reaches 4.5V. This can cause unintended flash 
memory program and erase if the correct command 
data values are “spuriously” written to the device. 


Again referencing Figure 7, the behaviour of processor/ 
logic CE#, WE# and address/data outputs are typi- 
cally undefined once Vcc drops below 4.5V. If the 
power supply Vpp output is more capacitively loaded 
than Vcc, Vpp can remain above Vppy as Vcc decays 
toward OV. This has the potential to initiate program/ 
erase operations in response to unintended flash memo- 
ry writes. 


6.1 Designing for Flash Memory 
System Power Sequencing 
Protection 


Intel has taken several steps with respect to its flash 
memory designs to significantly minimize the possibili- 
ty of an unwanted write during system powerup or 
powerdown. By synergizing system designs to these 
flash memory features, you can easily eliminate the po- 
tential for unwanted flash memory mode switching 
and/or data alteration. 


Flash memories from Intel are guaranteed not to pro- 
gram or erase with Vpp below 6.5V. First generation 
bulk-erase devices additionally block al/ write attempts 
with Vpp below 6.5V. The implication here is clear; if 
possible, don’t switch on Vpp until after the system 
Vcc is stable (on powerup), and switch off Vpp before 
the system is powered down. The Vpp supply itself can 
be switched on/off, or an inline FET switch can be 
installed between the power supply output~and flash 
memory input and controlled via an I/O line from the 
processor or discrete logic. Figure 6 gives an example of 
circuitry for the former case. 
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Figure 8. Supply Voltage/Device Output 
Relationship During Powerup 


Intel flash memory also provides Vcc-driven “lockout 
protection” from unwanted writes. With Vcc below 
VLKo> all write attempts to the flash memory are ig- 
nored. Vi Ko varies between 2.5V and 2.0V depending 
on the specific flash memory, and its value is targeted 
to take advantage of the fact that in most cases device 
outputs closely follow Vcc inputs (both up and down). 
Referencing Figure 8, when Vcc exceeds Vj] xo, device 
outputs will in most cases also be at approximately 
VLKo, and consequently at a TTL “1” level (or dis- 
abled). The flash memory “protects itself” up to VLKo, 
and the system designer must above that point ensure 
that flash memory control inputs are stable. Similarly, 
the flash memory is again protected once Vcc drops 
below VLKo on system powerdown. 


~The RP# input (formerly known as PWD #), available 
on Intel Boot Block and FlashFile memories, acts as a 
“master on/off switch” for the device. With RP# at 
V1, the flash memory is put in a very low power mode 
called Deep Powerdown, and is essentially turned 
“off’. In this state, all write attempts to the flash mem- 
ory are disregarded. RP# can be driven by the 
POWERGOOD output of the system power supply (if 
this output exists) or from an external analog “power 
supply monitoring” device like the Maxim MAX705 or 
Motorola MC34064, providing absolute flash memory 
protection. Figure 9 gives an example system design 


2-48 


a 

intel ° 
using the Maxim component. Voltage monitoring cir- 
cuits like those mentioned above have adjustable trip 


points and tight tolerances, and can be set to the lower 
value of the system logic normal operating voltage. 


Flash 
Memory 


EXTERNAL 
RESET# 


SYSTEM 
RESET# 
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Figure 9. Reset Control during 
System Powerup and Powerdown 


7.0 SUMMARY 


Unintended writes to flash memory can, at a minimum, 
cause it to output data that the system does not expect, 
forcing system reset or power sequencing to restore 
normal operation. Depending on the specific data writ- 
ten to the device, and the Vpp voltage at the time of the 
write, actual “permanent” alteration of flash memory 
contents can result from unintended program or erase. 
However, Intel flash memory, in combination with 
proper system interfacing techniques, easily eliminates 
the potential for either of these scenarios. 


Closely analyze the powerup/down and reset behaviour 
of the system CPU and any interface logic that inter- 
acts with the flash memory. In the vast majority of 
cases, no problems will be found. If potential for un- 
wanted writes does exist, however, nonvolatile/rewrite- 
able memory protection can easily be included if incor- 
porated early in the design, by following the hints de- 
scribed in this application note. 
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Recently, several laser printer and printer peripheral 
companies have introduced products that incorporate 
flash memory. Their advertisements validate the unique 
capabilities and benefits that flash memory features 
provide. OEM interest, and predictions by market ana- 
lysts like BIS Strategic Decisions, point to increasing 
future flash memory usage as laser printer manufactur- 
ers continue to differentiate their product lines to meet 
user needs. This application brief discusses the uses and 
benefits of flash memory in laser printer designs. Specif- 
ically, flash memory usage for system code storage, and 
for font and “font-like” data storage, will be highlight- 
ed. 


1.0 INTRODUCTION 


Within the computer industry, the laser printer market 
is one of the most rapidly growing business sectors. The 
graph of Figure 1 shows growth rate of various market 
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segments since 1988, as well as predicted growth 
through 1996. Laser printer proliferations are expand- 
ing to capture the needs of more and more user groups. 
Simultaneously, more and more computer users are 
turning to laser printers versus traditional “impact 
printer” alternatives, as features proliferate, capabilities 
expand, offices become more automated, and unit 
prices fall. This combination grows the total number of 
laser printer market segments, as well as the size of 
each segment. ; 


When a large and steadily increasing supply of poten- 
tial laser printer users exists, the “invisible hands” of 
economics unequivocally dictate that a large number of 
suppliers will appear to service this demand. What does 
this all mean to you, the laser printer manufacturer/de- 
signer? In a word, competition! How can any one com- 
pany expand (or at a minimum maintain) their market 
share over the efforts of all others? 
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Figure 1. Laser Printer U.S. Market Growth 1988-1996 
(BIS Strategic Decisions, 1992) 
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One way to do this is by providing equivalent product 
features as all other suppliers, at a lower unit price. 
This is referred to as pricing-driven demand. Unfortu- 
nately, as in the example of the “clone” market in to- 
day’s PC industry, pricing-driven demand does not of- 
ten translate to long-term financial health for your 
company. 


The other method of establishing a leadership image 
(and the preferable means) is by stimulating differentia- 
tion-based demand through key product features that 
uniquely answer market needs. The advantages to this 
approach are many: 


© Product differentiation makes good business market 
share sense. Uniquely meeting customer needs 
through product features establishes a short-term 
leadership image and the potential for a long-term 
protectable market position. 


© Value-based pricing also makes good business prof- 
itability sense. If product features are chosen care- 
fully, the resultant customer demand allows the sup- 
plier to price comfortably above per-unit cost, guar- 
anteeing profitability and long term business health! 


Flash memory is a key technology whose capabilities 
trendsetting OEMs are exploiting to differentiate their 
current and future laser printer designs. It enables clear 
benefits in system expandability, flexibility, perform- 
ance and ease-of-use; benefits that translate directly to 
customer satisfaction and long-term loyalty. Flash 
memory combines the attributes of nonvolatility (like 
ROM or EPROM) and in-system updateability (like 
RAM or a hard disk drive), while simultaneously pro- 
viding high density and compatible read performance 
to DRAM. This unique combination of features allows 
flash memory to not only replace more “traditional” 
laser printer memory approaches, but also to enhance 
systems beyond the limitations of these “‘conservative” 
memory solutions. The remainder of this application 
brief will review the major memory subsystems in to- 
day’s laser printer designs, and how flash memory ca- 
pabilities can be applied in each case. 


2.0 MEMORY USAGE IN LASER 
PRINTERS 


A high-level laser printer block diagram is shown in 
Figure 2. Memory uses in laser printers can be grouped 
in the following three areas: 


e System and PDL (printer description language) em- 
ulation code storage 


e Font (and font-like data type) storage 
e Temporary bitmap image storage and manipulation 


Memory is used differently in each case: therefore opti- 


mum memory features are similarly specialized, even 
within a common memory technology. Semiconductor 
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vendors, for example, have optimized various types of 
DRAMs for the applications in which they’ll be used. 
Similarly, Intel has optimized unique product “fami- 
lies” within its flash memory line to match the require- 
ments of applications like those found in laser printers. 
These product “families” will be referred to in the dis- 
cussions below. 


2.1 System Code Memory 


The system code memory stores the software that is 
executed by the embedded processor to run and control 
the laser printer. This includes code to interface the 
processor with the input/output, coprocessor, print 
drum and motor subsystems. System code memory also | 
includes a large amount of software devoted to emulat-: 
ing various printer description languages. The most 
commonly known PDLs are PostScript* (pioneered by 
Adobe and currently at version 2.0) and PCL* (Printer 
Control Language, pioneered by Hewlett Packard and 
currently at version 5). Beyond these two “industry 
standards”, dozens of additional proprietary “lan- 
guages” have been developed by various hardware and 
software vendors. 


Depending on the complexity and capabilities of the 


_ laser printer and the number of supported emulations, 


system code size varies. It ranges from as little as 
256 Kbytes for an entry-level personal printer to several 
Mbytes for powerful high-end network laser printers. 
The traditional memory technology used to store sys- 
tem code is high density ROM (for nonvolatility) shad- 
owed to DRAM on system powerup (for fast read ac- 
cess time). 


Flash memory, when used for system code storage, 
combines the nonvolatility and high density of ROM 
with the fast read performance of DRAM, making the 
ROM/DRAM redundancy unnecessary. Additionally, 
the in-system upgradeability of flash memory makes la- 


‘ser printers flexible and updateable both in the manu- 


facturing line at your factory, and once the system is in 
the hands of the end customer. Although the per-device 
cost of flash memory is higher than that of ROM, flash 
memory’s upgradeability can result in a lower system 
cost through a laser printer’s operating lifetime. 


Flash memory eliminates costly inventory of ROMs, 
ROMs that must be scrapped if an enhanced software 
version is released or a software “bug” is discovered. 
Using flash memory, one hardware design can service 
multiple markets via simple “end-of-line” program- 
ming as the system leaves the factory. Additionally, di- 
agnostic code can be programmed on the assembly line 
for full system debug, and replaced with the final soft- 
ware version later in the manufacturing flow. 
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Today, upgradeability once a system reaches the cus- 
tomer’s hands is achieved via proprietary, costly add-in 
ROM cards. These emulation modules connect to the 
host system through low-performance interface buses. 
Updating the local code memory in the printer requires 
a technician visit, is very costly to the customer, and is 
therefore rarely done. The result can be a less-than-op- 
timized system with subpar performance, and a dissat- 
isfied customer that will not consider your company for 
his/her next printer purchase! 


Flash memory’s in-system reprogramming makes sys- 
tem code upgrade as simple as running an “UPDATE” 
utility on the host computer, and can be done by the 
customer at his/her PC using a diskette sent by the 
printer manufacturer, or a file downloaded from a 
OEM computer bulletin board service. Configuring the 
printer with the exact emulations needed is equally 
straightforward. Customer service is perhaps the su- 
preme differentiator in multiple-source markets. As 
companies focus more and more on the customer and 
the service aspects of their business, they will turn to 
flash memory as a means of readily and economically 
achieving their goals. 


Intel’s Boot Block flash memory product line has been 
specifically defined to meet the specific requirements of 
high-density embedded code storage and execution. 
These devices are also available in ROM-compatible 
pinouts. This allows printer OEMs to achieve quick 
time-to-market with rev. 0 software (updateable once 
initial systems are in customer hands) and later convert 
their designs to ROM if desired, once final production 
code is stable. For further information on these prod- 
ucts, reference the Additional Information section at 
the conclusion of this application brief. 


2.2 Font Storage 


Today’s laser printers ship from the factory with a 
number of “resident” fonts stored in nonvolatile ROM. 
The density of this memory varies with the end market 
for the printer. A “Roman” set of resident typefaces 
requires anywhere from 1 Mbyte—2 Mbytes of storage. 
Japanese “‘Kanjii’’ fonts, on the other hand, require up- 
wards of 5 Mbytes per typeface. A minimum-config- 
ured laser printer for the Japanese market therefore 
needs 10 Mbytes—20 Mbytes of resident font memory. 
Additional permanent font storage is often available 
through ROM font cartridges, similar to the “‘emula- 
tion” fonts mentioned earlier. Finally, software such as 
Adobe Type Manager* and Microsoft* TrueType* 
downloads font information to the printer, storing it in 
volatile DRAM. This latter temporary font data is lost 
when the printer is turned off or reset. Resets can oc- 
cur, for example, each time the printer output jams, or 
when the paper supply is depleted. 
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Computer users are more and more outgrowing the ca- 
pabilities of the resident ROM fonts stored in their la- 
ser printers, or available through the ROM expansion 
font cartridges. ATM and TrueType are enabling these 
users to customize their documents by varying not only 
font size and attributes, but also the font typefaces 
themselves. Many corporations have developed custom 
fonts for use by their employees for a consistent docu- 
mentation “look and feel’. These unique typefaces are 
not a part of the resident standard typeface set. Finally, 
not only fonts, but also graphic bitmaps (corporate lo- 
gos, bitmapped signatures, etc.) and page layout tem- 
plates are being integrated into desktop-published doc- 
uments. All of this non-resident information must be 
repeatedly downloaded from the host computer to the 
printer DRAM after each printer poweroff or reset. 
Since this download is accomplished via the serial or 
parallel connection, print performance is dramatically 
and negatively impacted, especially noticeable in a net- 
worked printer arrangement. 


Flash memory, with its unique set of attributes, com- 
bines the best qualities of today’s font and template 
storage solutions while incorporating none of their 
weaknesses. Like DRAM, it is in-system updateable 
and has comparable per-device cost at higher densities. 
Like ROM, it is nonvolatile. Like both of these technol- 
ogies, it is a very dense storage medium, available in 
sizes up to 1 Mbyte per component, and 20 Mbytes per 
card, at the time this application note was written. 
Where extremely high density memory is needed, as in 
the case of Kanjii font storage, flash memory compo- 
nents have an over 200,000x first read access advantage 
and an over 14x data transfer performance advantage 
over hard disk drives. The performance of a printer 
computing subsystem is significantly hindered by the 
slow access time of a HDD. Flash memory, with its 
sub-100 ns read speed, is the superior solution. 


A resident high-density array of flash memory is cou- 
pled directly to the CPU local bus for highest perform- 
ance. It allows the customer to exactly configure the 
printer font, bitmap graphic and page template infor- 
mation for his/her specific applications. This data is 
downloaded to the printer once, and from that point on 
is always available for use, even after the printer is 
turned off or reset. If expanded printer usage (as in a 
network environment) requires additional resident 
“font” storage in the future, easy density upgrade is 
enabled by designing in a PCMCIA memory-I/O card 
socket, again interfacing directly to the embedded proc- 
essor bus. Plugging in a flash memory card means no 
printer disassembly is required! 


intel. 


Intel’s FlashFileT™ flash memory component and Se- 
ries 2 flash memory card lines combine the high density 
and high performance required for resident “font” stor- 
age. For further information on these products, refer- 
ence the Additional Information section at the conclu- 
sion of this application brief. 


2.3 Image Storage and Manipulation 


The temporary graphic memory subsystern stores the 
image to be printed as it is “constructed” by the proces- 
sor from data provided by the host computer. Optimum 
characteristics of this memory include full “real-time” 
bit-level alteration, infinite rewrite capability and fast 
read/write performance. Nonvolatility is not required 
in this area of the memory subsystem. Therefore, 
DRAM will continue to be the memory of choice for 
temporary image storage. 


ADDITIONAL INFORMATION 


AB-29 


3.0 SUMMARY 


This application brief has discussed the various memo- 
ry subsystems in today’s laser printers, and their oper- 
ating characteristics. Flash memory is an exciting new 
approach that offers the very real potential to signifi- 
cantly improve your next-generation laser printer de- 
signs. Its capabilities are superior to traditional solu- 
tions in the system code and font memory areas, and 
enable laser printers that are more expandable, more 
flexible, higher performance and easier to use than ever 
before. The end result is a satisfied customer, a custom- 
er that will choose your product over a competitor’s, 
and a customer that will remain loyal to your company 
far into the future. 


For additional information on the Intel flash memory products mentioned in this article, please reference the 
following documents, available through your local Intel sales representative. | 


- Boot Block Components 
28F001BX Datasheet 
28F200BX/28F002BX Datasheet 
28F400BX/28F004BX Datasheet 


ER-26 “The Intel 28F001BX-T and 28F001BX-B Flash Memories” 
ER-29 “The Intel 2/4 Mbit Boot Block Flash Memory Family” 


FlashFile Components 

28F008SA Datasheet 

AP-359 “28FO08SA Hardware Interfacing” 
AP-360 ‘‘28FO08SA Software Drivers” 

AP-364 ‘‘28FO08SA Automation and Algorithms’”’ 
ER-27 “The Intel 28FO08SA Flash Memory” 


FlashFile Series 2 Cards 
Series 2 Flash Memory Card Datasheet 


AP-361 “Implementing the Integrated Registers of the Series 2 Flash Memory Card” 


General Flash Information 


AP-357 ‘Power Supply Solutions for Flash Memory” 


ER-20 ‘“ETOX II Flash Memory Technology” 
ER-28 ‘“ETOX Ill Flash Memory Technology” 


Order Number 
290406 
290448 
290451 
294010 
294013 


Order Number 
290429 
292094 
292095 
292099 
294011 


Order Number 
290434 
292096 


Order Number 
292092 
294005 
294012 


*Microsoft and TrueType are trademarks of Microsoft Corporation. Adobe Type Manager and PostScript are 
trademarks of Adobe Systems Incorporated. PCL is a trademark of Hewlett Packard Corporation. ETOX and 


FlashFile are trademarks of Intel Corporation. 
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n ADVANCE INFORMATION 


DD28F032SA 
32-MBIT (2 MBIT x 16, 4 MBIT x 8) 
FLASHFILE™ MEMORY 


m User-Selectable 3.3V or 5V Vcc g Revolutionary Architecture 
mw User-Configurable x8 or x16 Operation Mates Compatible with 
= 70 ns Maximum Access Time — Pipelined Command Execution 
m 0.43 MB/sec Write Transfer Rate — Write during Erase 
= 1 Million Erase Cycles per Block m 2 mA Typical Icc in Static Mode 
m 56-Lead, 1.2 x 14 x 20mm Dual Die m 2A Typical Deep Power-Down 
Advanced TSOP Package Technology m 64 Independently Lockable Blocks 
m State-of-the-Art 0.6 um ETOX IV Flash 


Technology 


Intel’s DD28F032SA 32-Mbit FlashFile™’ Memory is a revolutionary architecture which enables the design of 
truly mobile, high performance, personal computing and communication products. With innovative capabilities, 
low power operation and very high read/write performance, the DD28F032SA is also the ideal choice for 
designing embedded mass storage flash memory systems. 


The DD28F032SA is the result of highly advanced packaging innovation which encapsulates two 28F016SA 
die in a single Dual Die Thin Small Outline Package (DDTSOP). 


The DD28F032SA is the highest density, highest performance non-volatile read/write solution for solid-state 
storage applications. Its symmetrically blocked architecture (100% compatible with the 28FO16SA 16-Mbit 
FlashFile memory), very high cycling, low power 3.3V operation, very fast write and read performance and 
selective block locking provide a highly flexible memory component suitable for high density memory cards, 
Resident Flash Arrays and PCMCIA-ATA Flash Drives. The DD28F032SA’s dual read voltage enables the 
design of memory cards which can interchangeably be read/written in 3.3V and 5.0V systems. Its x8/x16 
architecture allows the optimization of memory to processor interface. The flexible block locking option en- 
ables bundling of executable application software in a Resident Flash Array or memory card. The 
DD28F032SA will be manufactured on Intel’s 0.6 wm ETOX IV technology. 


32 Mbit 


Figure 1 


October 1993 
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DD28F032SA 


1.0 PRODUCT OVERVIEW 


The DD28F032SA is a high performance 32-Mbit 
(33,554,432-bit) block erasable non-volatile random 
access memory organized as either 2 Mword x 16 or 
4 Mbyte x 8. The DD28F032SA is built using two 
28F016SA chips encapsulated in a single 56L-TSOP 
type | package. The DD28F032SA includes sixty- 
four 64-KB (65,536) blocks or sixty-four 32-KW 
(32,768) blocks. 


The implementation of a new architecture, with 
many enhanced features, will improve the device op- 
erating characteristics and results in greater product 
reliability and ease of use. 


Among the significant enhancements on the 
DD28F032SA: 


e 3.3V Low Power Capability 
e Improved Write Performance 
e Dedicated Block Write/Erase Protection 


A 3/5# input pin reconfigures the device internally 
for optimized 3.3V or 5.0V read/write operation. 


The DD28F032SA will be available in a 56-lead, 
1.2mm thick, 14mm x 20mm Dual Die TSOP type 1 
package. This form factor and pinout allow for very 
high board layout densities. The DD28F032SA is 
pinout and footprint compatible with the 28FO16SA. 


A Command User Interface (CUI) serves as the sys- 
tem interface between the microprocessor or micro- 
controller and the internal memory operation. 


Internal Algorithm Automation allows Word/Byte 
Writes and Block Erase operations to be executed 
using a Two-Write command sequence to the CUI in 
the same way as the 28F016SA 16-Mbit FlashFile 
memory. 


A Superset of commands have been added to the 
basic 28FO08SA (8-Mbit flashfile memory) com- 
mand-set to achieve higher write performance and 
provide additional capabilities. These new com- 
mands and features include: 

e Page Buffer Writes to Flash 

© Command Queueing Capability 

e Automatic Data Writes during Erase 

e Software Locking of Memory Blocks 

¢ Two-Byte Successive Writes in 8-bit Systems 
e Erase All Uniocked Blocks 


Writing of memory data is performed in either byte or 
word increments typically within 6 ws, a 33% im- 
provement over the 28FOO8SA. A Block Erase oper- 
ation erases one of the 64 blocks in typically 0.6 sec, 
independent of the other blocks, which is a 65% 
improvement over the 28FOO8SA. 


3-2 
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intel. 
Each block can be written and erased a minimum of 
100,000 cycles. Systems can achieve 1 million Block 
Erase Cycles by providing wear-leveling algorithms 
and graceful block retirement. These techniques 


have already been employed in many flash file sys- 
tems and in Hard Disk Drive designs. 


The DD28F032SA incorporates four Page Buffers of 
256 Bytes (128 Words) each to allow page data 
writes. This feature can improve a system write per- 
formance by up to 4.8 times over previous flash 
memory devices. 


All operations are started by a sequence of Write 
commands to the device. Three Status Registers 
(described in detail later) and a RY/BY # output pin 
provide information on the progress of the requested 
operation. 


The DD28F032SA allows queueing of the next oper- 
ation while the memory executes the current opera- 
tion. This eliminates system overhead when writing 
several bytes in a row to the array or erasing several 
blocks at the same time. The DD28F032SA can also 
perform write operations to one block of memory 
while performing erase of another block. However, 
simultaneous write and/or erase operations are not 
allowed on both 28F016SA devices. See modes of 
operation in Section 3.0. 


The DD28F032SA provides user-selectable block 
locking to protect code or data such as Device Driv- 
ers, PCMCIA card information, ROM-Executable 
O/S or Application code. Each block has an associ- 
ated non-volatile lock-bit which determines the lock 
status of the block. In addition, the DD28FO32SA 
has a master Write Protect pin (WP#) which pre- 
vents any modifications to memory blocks whose 
lock-bits are set. 


The DD28F032SA contains three types of Status 
Registers to accomplish various functions: 


e A Compatible Status Register (CSR) which is 
100% compatible with the 28FOO8SA FlashFile 
memory’s Status Register. This register, when 
used alone, provides a straightforward upgrade 
capability to the DD28F032SA from a 28FO08SA- 
based design. 


e A Global Status Register (GSR) which informs 
the system of command Queue status, Page 
Buffer status, and overall Write State Machine 
(WSM) status. 


e 64 Block Status Registers (BSRs) which provide 
block-specific status information such as the 
block lock-bit status. 


The DD28F032SA incorporates an open drain 
RY/BY # output pin. This feature allows the user to 
OR-tie many RY/BY# pins together in a multiple 
memory configuration such as a Resident Flash Ar- 
ray. 
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Other configurations of the RY/BY# pin are en- 
abled via special CUI commands.. 


Consult the 28F016SA user’s manual for more de- 
tail. 


The DD28F032SA incorporates three chip enable in- 
put pins: CEjg#, CE;# and CEo#. The active low 
combination of CEg# and CE;# controls the lower 
28F016SA. The active low combination of CEo# 
and CEo# controls the upper 28F016SA. 


_ The BYTE# pin allows either x8 or x16 read/writes 
to the DD28F032SA. BYTE# at logic low selects 
8-bit mode with address Ag selecting between low 
byte and high byte. On the other hand, BYTE# at 
logic high enables 16-bit operation with address A, 
becoming the lowest order address and address Ag 
is not used (don’t care). 


The DD28F032SA incorporates an Automatic Power 
Saving (APS) feature which substantially reduces 


2.1 Lead Descriptions 


operations. 


disabled. 


simultaneously. 
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| Symbol | Type Name and Function 


BYTE-SELECT ADDRESS: Selects between high and low byte when 
device is in x8 mode. This address is latched in x8 Data Writes. Not used 
in x16 mode (i.e., the Ag input buffer is turned off when BYTE # is high). 


WORD-SELECT ADDRESSES: Select a word within one 64-KByte block. 
Ag—-Ai5 selects 1 of 1024 rows, and A;—As selects 16 of 512 columns. 
These addresses are latched during Data Writes. 


BLOCK-SELECT ADDRESSES: Select 1 of 32 Erase blocks. These 
addresses are latched during Data Writes, Erase and Lock-Block 


LOW-BYTE DATA BUS: Inputs data and commands during CUI write 
cycles. Outputs array, buffer, identifier or status data in the appropriate 
Read mode. Floated when the chip is de-selected or the outputs are 


HIGH-BYTE DATA BUS: Inputs data during x16 Data-Write operations. 
Outputs array, buffer or identifier data in the appropriate Read mode; not 

used for Status register reads. Floated when the chip is de-selected or the 
outputs are disabled. 


CHIP ENABLE INPUTS: Activate the device’s control logic, input buffers, 
decoders and sense amplifiers. CE9#, CE, # disable/enable Lower 
28F016SA while CEg#, CEo# disable/enable Upper 28F016SA. CEg # 
active low enables chip operation while CE; # or CEs # select between 
the lower and upper 2 MBytes. CE; # and CEo# must not be active low 


RESET/POWER-DOWN: FP # low places the device in a Deep Power- 
Down state. All circuits that burn static power, even those circuits enabled 
in standby mode, are turned off. When returning from Deep Power-Down, 
a recovery time is required to allow these circuits to power-up. 

When RP # goes low, any current or pending WSM operation(s) are 
terminated, and the device is reset. All Status registers return to ready 
(with all status flags cleared). 


DD28F032SA 


the active current when the device is in static mode 
of operation (addresses not switching). 


A Deep Power-Down mode of operation is invoked 
when the RP# (called PWD on the 28F008SA) pin 
transitions low. This mode provides additional write 
protection by acting as a device reset pin during 
power transitions. In the Deep Power-Down state, 
the WSM is reset (any current operation will abort) 
and the CSR, GSR and BSR registers are cleared. 


A CMOS Standby mode of operation is enabled 
when either CEj# or both CE;# and CEo# tran- 
sition high and RP# stays high with all input control 
pins at CMOS levels. 


2.0 DEVICE PINOUT 


The DD28F032SA 56L-Dual Die TSOP Type | pinout 
configuration is shown in Figure 1. 
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Type Name and Function 


INPUT OUTPUT ENABLE: Gates device data through the output buffers when low. 
} The outputs float to tri-state off when OE # is high. 
age = 


ak NOTE: CEx # overrides OE #, and OE # overrides WE #. 

WE # WRITE ENABLE: Controls access to the CUI, Page Buffers, Data Queue 
Registers and Address Queue Latches. WE # is active low, and latches both 
address and data (command or array) on its rising edge. 

RY/BY # | OPEN DRAIN 

OUTPUT 
hie 

fe wee 

3/5# INPUT 
NOTES: Reading the array with 3/5 # high in a 5.0V system could damage the 
device. 
There is a significant delay from 3/5 # switching to access valid data. 

— 

"sa 


mode. This output is always active (i.e., not floated to tri-state off when OE # or 
CE o#, CE, # are high), except if a RY/BY # Pin Disable command is issued. 


WRITE PROTECT: Erase blocks can be locked by writing a non-volatile lock-bit . 
for each block. When WP # is low, those locked blocks as reflected by the 
Block-Lock Status bits (BSR.6), are protected from Data Writes or Erases. 

When WP # is high, all blocks can be Written or Erased regardless of the state 
of the lock-bits. The WP # input buffer is disabled when RP # transitions low 
(Deep Power-Down mode). 


BYTE ENABLE: BYTE # low places device in x8 mode. All data is then input or 
output on DQ9-DQ7, and DQg-DQj5 float. Address Ap selects between the 

high and low byte. BYTE # high places the device in x16 mode, and turns off the 
Ao input buffer. Address A;, then becomes the lowest order address. 


3.3V/5.0V SELECT: 3/5# high configures internal circuits for 3.3V operation. 
3/5# low configures internal circuits for 5.0V operation. 


READY/BUSY: Indicates status of the internal WSM. When low, it indicates that 
the WSM is busy performing an operation. RY/BY # high indicates that the 
WSM is ready for new operations (or WSM has completed all pending 
operations), or Erase is Suspended, or the device is in Deep Power-Down 

SUPPLY ERASE/WRITE POWER SUPPLY: For erasing memory array blocks or writing 
words/bytes/pages into the flash array. 

SUPPLY DEVICE POWER SUPPLY (3.3V + 0.3V, 5.0V + 0.5V): Do not leave any 
power pins floating. 

SUPPLY GROUND FOR ALL INTERNAL CIRCUITRY: Do not leave any ground pins 
floating. 

ee NO CONNECT: No internal connection to die, lead may be driven or left floating 
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DD28F032SA 
56 —- LEAD TSOP PINOUT 


14 mm x 20 mm 
TOP VIEW 


Figure 2. TSOP Pinout Configuration 


3.0 MODES OF OPERATION 


Lower Upper DD28F032SA 
28F016SA 28F016SA Chip 
Standby Standby 


Standby 
Standby Standby 


Illegal Condition 


X = Don’t Care 
DPD = Deep Power-Down 
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28F016SA 
16 MBIT (1 MBIT x 16, 2 MBIT x 8) 
FLASHFILE™ MEMORY 


m User-Selectable 3.3V or 5V Vcc m@ Revolutionary Architecture 
m User-Configurable x8 or x16 Operation — Pipelined Command Execution 
; — Write During Erase 
m@ 70 ns Maximum Access Time — Command Superset of Intel 
m 0.43 MB/sec Write Transfer Rate 28F008SA 
g 1 Million Erase Cycles per Block m= 1 mA Typical Icc in Static Mode 
m 56-Lead, 1.2mm x 14mm x 20mm TSOP = 1A Typical Deep Power-Down 
Package m 32 Independently Lockable Blocks 
m@ State-of-the-Art 0.6 1m ETOX IV Flash 
Technology 


Intel’s 28FO016SA 16-Mbit FlashFile™’ Memory is a revolutionary architecture which enables the design of truly 
mobile, high performance, personal computing and communication products. With innovative capabilities, low 
power operation and very high read/write performance, the 28F016SA is also the ideal choice for designing 
embedded mass storage flash memory systems. 


The 28F016SA is a very high density, highest performance non-volatile read/write solution for solid-state 
storage applications. Its symmetrically blocked architecture (100% compatible with the 28FOO8SA 8-Mbit 
FlashFile™™’ memory), extended cycling, low power 3.3V operation, very fast write and read performance and 
selective block locking provide a highly flexible memory component suitable for high density memory cards, 
Resident Flash Arrays and PCMCIA-ATA Flash Drives. The 28F016SA’s dual read voltage enables the design 
of memory cards which can interchangeably be read/written in 3.3V and 5.0V systems. Its x8/x16 architecture 
allows the optimization of memory to processor interface. The flexible block locking option enables bundling of 
executable application software in a Resident Flash Array or memory card. Manufactured on Intel’s 0.6 wm 
ETOXIV process technology, the 28F016SA is the most cost-effective, high-density 3.3V flashfile memory. 
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1.0 INTRODUCTION 


The documentation of the Intel 28F016SA memory 
device includes this data sheet, a detailed user’s 
manual, and a number of application notes, all of 
which are referenced at the end of this data sheet. 


The data sheet is intended to give an overview of 
the chip feature-set and of the operating AC/DC 
specifications. The 28F016SA User’s Manual pro- 
vides complete descriptions of the user modes, sys- 
tem interface examples and detailed descriptions of 
all principles of operation. It also contains the full list 
of software algorithm flowcharts, and a brief section 
on compatibility with Intel 28FOO8SA. 


1.1 Product Overview 


The 28F016SA is a high performance 16 Mbit 
(16,777,216 bit) block erasable non-volatile random 
access memory organized as either 1 Mword x 16 or 
2 Mbyte x 8. The 28F016SA includes thirty-two 64 
KB (65,536) blocks or thirty-two 32-KW (32,768) 
blocks. A chip memory map is shown in Figure 3. 


The implementation of a new architecture, with 
many enhanced features, will improve the device op- 
erating characteristics and results in greater product 
reliability and ease of use. 


Among the _ significant enhancements on the 
28F016SA: 


@ 3.3V Low Power Capability 
e Improved Write Performance 
e Dedicated Block Write/Erase Protection 


A 3/5# input pin reconfigures the device internally 
for optimized 3.3V or 5.0V read/write operation. 


The 28F016SA will be available in a 56-lead, 1.2mm 
thick, 14mm x 20mm TSOP type 1 package. This 
form factor and pinout allow for very high board lay- 
out densities. 


A Command User Interface (CUI) serves as the sys- 
tem interface between the microprocessor or micro- 
controller and the internal memory operation. 


Internal Algorithm Automation allows Byte/Word 
Writes and Block Erase operations to be executed 
using a Two-Write command sequence to the CUI in 
the same way as the 28FO08SA 8-Mbit FlashFile™ 
memory. 
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A Superset of commands have been added to the 
basic 28FOO8SA command-set to achieve higher 
write performance and provide additional capabili- 
ties. These new commands and features include: 


e Page Buffer Writes to Flash 

e Command Queuing Capability 

e Automatic Data Writes During Erase 

e Software Locking of Memory Blocks 

e Two-Byte Successive Writes in 8-bit Systems 
e Erase All Unlocked Blocks 


Writing of memory data is performed in either byte or 
word increments typically within 6 psec, a 33% im- 
provement over the 28FO08SA. A Block Erase oper- 
ation erases one of the 32 blocks in typically 0.6 sec, 
independent of the other blocks, which is about 65% 
improvement over the 28FOO8SA. 


Each block can be written and erased a minimum of 
100,000 cycles. Systems can achieve 1 million Block 
Erase Cycles by providing wear-leveling algorithms 
and graceful block retirement. These techniques 
have already been employed in many flash file sys- 
tems and Hard Disk Drive designs. 


The 28F016SA incorporates two Page Buffers of 
256 Bytes (128 Words) each to allow page data 
writes. This feature can improve a system write per- 
formance by up to 4.8 times over previous flash 
memory devices. 


All operations are started by a sequence of Write 
commands to the device. Three Status Registers 
(described in detail later) and a RY/BY # output pin 
provide information on the progress of the requested 
operation. 


While the 28FOO8SA requires an operation to com- 
plete before the next operation can be requested, 
the 28F016SA allows queuing of the next operation 
while the memory executes the current operation. 
This eliminates system overhead when writing sev- 
eral bytes in a row to the array or erasing several 
blocks at the same time. The 28F016SA can also 
perform write operations to one block of memory 
while performing erase of another block. 


The 28F016SA provides user-selectable block lock- 
ing to protect code or data such as Device Drivers, 
PCMCIA card information, ROM-Executable O/S or 
Application Code. Each block has an associated 
non-volatile lock-bit which determines the lock 
status of the block. In addition, the 28FO016SA has a 
master Write Protect pin (WP #) which prevents any 
modifications to memory blocks whose lock-bits are 
set. 
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The 28F016SA contains three types of Status Reg- 
isters to accomplish various functions: 


e A Compatible Status Register (CSR) which is 
100% compatible with the 28FO08SA FlashFile 
memory’s Status Register. This register, when 
used alone, provides a straightforward upgrade 
capability to the 28F016SA from a 28FO08SA- 
based design. 


e A Global Status Register (GSR) which informs 
the system of command Queue status, Page 
Buffer status, and overall Write State Machine 
(WSM) status. 


e 32 Block Status Registers (BSRs) which provide 
block-specific status information such as the 
block lock-bit status. 


The GSR and BSR memory maps for Byte-Wide and 
Word-Wide modes are shown in Figures 4.1 and 4.2. 


The 28F016SA incorporates an open drain RY/BY # 
output pin. This feature allows the user to OR-tie 
many RY/BY # pins together in a multiple memory 
configuration such as a Resident Flash Array. 


Other configurations of the RY/BY# pin are en- 
abled via special CUI commands and are described 
in detail in the 28FO016SA User’s Manual. 


The 28F016SA also incorporates a dual chip-enable 
function with two input pins, CEg# and CE,#. 
These pins have exactly the same functionality as 
the regular chip-enable pin CE # on the 28F008SA. 
For minimum chip designs, CE;# may be tied to 
ground and use CEp# as the chip enable input. The 
28F016SA uses the logical combination of these two 
signals to enable or disable the entire chip. Both 
CEp# and CE;# must be active low to enable the 
device and if either one becomes inactive, the chip 
will be disabled. This feature, along with the open 
drain RY/BY# pin, allows the system designer to 
reduce the number of control pins used in a large 
array of 16-Mbit devices. 


The BYTE# pin allows either x8 or x16 read/writes 


to the 28F016SA. BYTE# at logic low selects 8-bit 
mode with address Ag selecting between low byte 
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and high byte. On the other hand, BYTE# at logic 
high enables 16-bit operation with address A; be- 
coming the lowest order address and address Ap is 
not used (don’t care). A device block seme is 
shown in Figure 1. 


The 28F016SA is specified for a maximum access 
time of 70 ns (tacc) at 5.0V operation (4.75V to 
5.25V) over the commercial temperature range (0°C 
to + 70°C). A corresponding maximum access time 
of 120 ns at 3.3V (3.0V to 3.6V and 0°C to + 70°C) is 
achieved for reduced power consumption. applica- 
tions. 


The 28F016SA incorporates an Automatic Power 
Saving (APS) feature which substantially reduces 
the active current when the device is in static mode 
of operation (addresses not switching). 


In APS mode, the typical Ico current is 1 mA at 5.0V 
(0.8 mA at 3.3V). 


A Deep Power-Down mode of operation is invoked 
when the RP# (called PWD on the 28FO08SA) pin 
transitions low. This mode brings the device power 
consumption to less than 1.0 pA, typically, and pro- 
vides additional write protection by acting as a de- 
vice reset pin during power transitions. A reset time 
of 400 ns is required from RP# switching high until 
outputs are again valid. In the Deep Power-Down 
state, the WSM is reset (any current operation will 
abort) and the CSR, GSR and BSR registers are 
cleared. 


A CMOS Standby mode of operation is enabled 
when either CEj# or CE;# transitions high and 
RP# stays high with all input control pins at CMOS 
levels. In this mode, the device typically draws an 
loc standby current of 50 pA. 


2.0 DEVICE PINOUT 


The 28F016SA 56L-TSOP Type | pinout configura- 
tion is shown in Figure 2. 
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Input 
Buffer 
Y-DECODER 


Pal 
X-DECODER : 
oe 


Y GATING/ SENSING 


RY /BY# 
a 
Program/Erasef@ V pp 
Voltage SwitchIe= 3/5# 


64-KBYTE 
64-KBYTE 
Block 30 
Block 31 


Voc 
4——= GND 


Figure 1. 28F016SA Block Diagram 
Architectural Evolution Includes Page Buffers, Queue Registers and Extended Status Registers. 
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2.1 Lead Descriptions | 


DQs-DQj5 


CEp#, CE; # 


0 
1- 
RP# 
E# 


| Name and Function 


BYTE-SELECT ADDRESS: Selects between high and low byte when 
device is in x8 mode. This address is latched in x8 Data Writes. Not used 
in x16 mode (i.e., the Ag input buffer is turned off when BYTE # is high). 


WORD-SELECT ADDRESSES: Select a word within one 64-Kbyte 
block. Ag_15 selects 1 of 1024 rows, and Aj-5 selects 16 of 512 
columns. These addresses are latched during Data Writes. 


-BLOCK-SELECT ADDRESSES: Select 1 of 32 Erase blocks. These 
addresses are latched during Data Writes, Erase and Lock-Block 
operations. | 


LOW-BYTE DATA BUS: Inputs data and commands during CUI write 
cycles. Outputs array, buffer, identifier or status data in the appropriate 
Read mode. Floated when the chip is de-selected or the outputs are 
disabled. 


HIGH-BYTE DATA BUS: Inputs data during x16 Data-Write operations. 
Outputs array, buffer or identifier data in the appropriate Read mode; not 
used for Status register reads. Floated when the chip is de-selected or 

the outputs are disabled. 


CHIP ENABLE INPUTS: Activate the device’s control logic, input 
buffers, decoders and sense amplifiers. With either CE9 # or CE, # high, 
the device is de-selected and power consumption reduces to Standby 
levels upon completion of any current Data-Write or Erase operations. 
Both CEj#, CE, # must be low to select the device. 3 
All timing specifications are the same for both signals. Device Selection 
occurs with the latter falling edge of CEg # or CE, #. The first rising edge 
of CEp# or CE; # disables the device. 


RESET/POWER-DOWN: FP # low places the device in a Deep Power- 
Down state. All circuits that burn static power, even those circuits 
enabled in standby mode, are turned off. When returning from Deep 
Power-Down, a recovery time of 400 ns is required to allow these circuits 
to power-up. : 
When RP# goes low, any current or pending WSM operation(s) are 
terminated, and the device is reset. All Status registers return to ready 
(with all status flags cleared). 


OUTPUT ENABLE: Gates device data through the output buffers when 
low. The outputs float to tri-state off when OE # is high. 

NOTE: 
CE, # overrides OE #, and OE# overrides WE#. 


WRITE ENABLE: Controls access to the CUI, Page Buffers, Data Queue 
Registers and Address Queue Latches. WE # is active low, and latches 
both address and data (command or array) on its rising edge. 


READY/BUSY: Indicates status of the internal WSM. When low, it 
indicates that the WSM is busy performing an operation. RY/BY # high 
indicates that the WSM is ready for new operations (or WSM has 
completed all pending operations), or Erase is Suspended, or the device 
is in deep power-down mode. This output is always active (i.e., not 
floated to tri-state off when OE # or CEp#, CE; # are high), except if a 
RY/BY # Pin Disable command is issued. 


Type 
INPUT 


INPUT 


INPUT 


INPUT/OUTPUT 


INPUT/OUTPUT 


INPUT 


INPUT 


INPUT 


RY/BY # 


INPUT 


OPEN DRAIN 
OUTPUT 
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2.1 Lead Descriptions (Continued) 


| Symbol Name and Function 
WP # 


WRITE PROTECT: Erase blocks can be locked by writing a non-volatile lock-bit for 
each block. When WP # is low, those locked blocks as reflected by the Block-Lock 
Status bits (BSR.6), are protected from inadvertent Data Writes or Erases. When 
WP # is high, all blocks can be Written or Erased regardless of the state of the lock- 
bits. The WP # input buffer is disabled when RP # transitions low (deep power-down 
mode). | 


BYTE ENABLE: BYTE # low places device in x8 mode. All data is then input or output 
on DQpo.7, and DQg.15 float. Address AO selects between the high and low byte. 

BYTE # high places the device in x16 mode, and turns off the Ag input buffer. Address 
A, then becomes the lowest order address. 


3.3/5.0 VOLT SELECT: 3/5# high configures internal circuits for 3.3V operation. 
3/5# low configures internal circuits for 5.0V operation. 
NOTES: 


BYTE# | INPUT 

3/5# INPUT 
7 Reading the array with 3/5# high in a 5.0V system could damage the device. 
There is a significant delay from 3/5 # switching to valid data. 


SUPPLY | ERASE/WRITE POWER SUPPLY: For erasing memory array blocks or writing words/ 
bytes/pages into the flash array. 


SUPPLY | DEVICE POWER SUPPLY (3.3V + 0.3V, 5.0V + 0.5V): 
Do not leave any power pins floating. 


GROUND FOR ALL INTERNAL CIRCUITRY: 

Do not leave any ground pins floating. 

NO CONNECT: 

No internal connection to die, lead may be driven or left floating. 


Type 
INPUT 


SUPPLY 


O 


oe RY /BY# 


E28FO16SA 
56-LEAD TSOP PINOUT 
14mm x 20mm 


TOP VIEW 


31 a BYTE# 


290489-3 


NOTE: 
56-LEAD TSOP Mechanical Diagrams and Dimensions are shown at the end of this specification 


Figure 2. TSOP Pinout Configuration 
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3.0 MEMORY MAPS 
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Figure 3. 28F016SA Memory Map (Byte-wide mode) 
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3.1 Extended Status Registers Memory Map 
X8 MODE A[20:0] X16 MODE A[20:1] 


1FOOO06H F8003H 
RESERVED RESERVED 

1FO0004H F8002H 
RESERVED RESERVED 

1FO0003H 

1FO0002H F8001H 
RESERVED RESERVED 


1FO001H 
RESERVED RESERVED 
1FOO0O0H F8000H 


010002H —  08001H 
RESERVED RESERVED 
000006H 


00003H 
000005H RESERVED 
cae 000003H RESERVED 
RESERVED care neal Ca ae al 
ee 000001H RESERVED 
000000H RESERVED 


00000H 
Figure 4.1 Extended Status Register Figure 4.2 Extended Status Register 
Memory Map (Byte-wide mode) Memory Map (Word-wide mode) 
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4.0 BUS OPERATIONS, COMMANDS AND STATUS REGISTER DEFINITIONS 


4.1 Bus Operations for Word-Wide Mode sear = Vin) 


[node [tes [are [cre [tae [oe [wee [a 
a 


-oapaDseble PS "4 Vin x x x | HighZ x 
ViH VIL 
a a 


eee ee tet a ta ta hte eee 
Toews | 4 | vw | vu | wu | vu | vm | vw | o600H [Von 
Twist welwivw iu lwiwilx! owl x. 


4.2 Bus Operations For Byte-Wide Mode (BYTE # = Vj) 


wows [hos [nro [eee [er [oe [wee [a [os [Rare 
ee ee ee 
| Output Disable | 1,6,7 | Se Oe ee High Z 


Standby ere "7 Vii High Z 
VIH VIL 
“4 4 


| Deep Power-Down | Power-Down VL | |X | HighZ~ Z 


ee TS ela re ete te 
pwrite | 56 | Vw | Me | Ye | vw | MW | X | Ow | xX | 


NOTES: 

1. X can be Vjy or Vi, for address or control pins except for RY/BY #, which is either Vo, or Vou. 

2. RY/BY # output is open drain. When the WSM is ready, Erase is suspended or the device is in deep power-down mode, 
RY/BY# will be at Voy if it is tied to Voc through a resistor. When the RY/BY# at Voy is independent of OE# while a 
WSM operation is in progress. 

3. RP# at GND + 0.2V ensures the lowest deep power-down current. 

4. Ao and A; at Vi, provide manufacturer ID codes in x8 and x16 modes repectively. 

Ao and A; at Vi provide device ID codes in x8 and x16 modes repectively. All other addresses are set to zero. 

5. Commands for different Erase operations, Data Write operations or Lock-Block operations can only be successfully com- 
pleted when Vpp = Vppy. 

6. While the WSM is running, RY/BY # in Level-Mode (default) stays at Vo, until all operations are complete. RY/BY # goes 
to Vou when the WSM is not busy or in erase suspend mode. 

7. RY/BY# may be at Vo, while the WSM is busy performing various operations. For example, a status register read during 
a write operation. 
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4.3 28F008SA—Compatible Mode Command Bus Definitions 


Read Compatible Status Register 


Clear Status Register 


ADDRESS DATA 

AA = Array Address AD = Array Data 
BA = Block Address CSRD = CSR Data 
lA = Identifier Address ID = Identifier Data 
WA = Write Address WD = Write Data 
X = Don’t Care 

NOTES: 


1. Following the intelligent identifier command, two Read operations access the manufacturer and device signature codes. 
2. The CSR is automatically available after device enters Data Write, Erase, or Suspend operations. 

3. Clears CSR.3, CSR.4 and CSR.5. Also clears GSR.5 and all BSR.5 and BSR.2 bits. 

See Status register definitions. 
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4.4 28F016SA—Performance Enhancement Command Bus Definitions 


Second Bus Cycle 
eel 
Status Register 
PageButferSwap | | 7 |Write| x 
ReadPageButfer | | [Write] x _| 75H | Read 

X 


ae 
pea ee ene ee bee et pal 
Page Buffer 
Pose ater 4,6,10 [Write] _x_| EOH | write 
Page Buffer Write | x8 |3,4,9,10| Write] _X_| OCH | Write 
lit 
| WoULA)| write] WA [ WOH.L) 
Wee ee BS 


Upload Status 
Bits/Confirm 
Upload Device 
Information 

Erase All Unlocked 
Blocks/Confirm 


Lee 8] 

pera en 3 
= A al al i al il 
Level-Mode 

oe A 

ees ceed 

ce ge 


~ 
nN 
a's 


w U0 a) 
w 
8 
ae 


= 
—_ 
— 
oO 
x 
ice) 
| 
oi 
Ei 
ok 
= 
4) 
x< 


Write CL) 
Mite) ee | ee a 
beso bese 2 8 a RD Ve aa aaa 


RY/BY # Pulse-On- 
Erase 


ADDRESS DATA 

BA = Block Address AD = Array Data WC (L,H) = Word Count (Low, High) 
PA = Page Buffer Address PD = Page Buffer Data BC (L,H) = Byte Count (Low, High) 
RA = Extended Register Address BSRD = BSR Data WD (L,H) = Write Data (Low, High) 
WA = Write Address GSRD = GSR Data 

X = Don’t Care 
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NOTES: 

1. RA can be the GSR address or any BSR address. See Figures 4.1 and 4.2 for Extended Status Register Memory Maps. 
2. Upon device power-up, all BSR lock-bits come up locked. The Upload Status Bits command must be written to reflect the 
actual lock-bit status. 

3. Ag is automatically complemented to load second byte of data. BYTE # must be at Vj,. 

Ao value determines which WD/BC is supplied first: Ag = 0 looks at the WDL/BCL, Ap = 1 looks at the WDH/BCH. 

4. BCH/WCH must be at OOH for this product because of the 256-Byte (128 Word) Page Buffer size and to avoid writing the 
Page Buffer contents into more than one 256-Byte segment within an array block. They are simply shown for future Page 
Buffer expandability. 

5. In x16 mode, only the lower byte DQp.7 is used for WCL and WCH. The upper byte DQg.15 is a don’t care. 

6. PA and PD (whose count is given in cycles 2 and 3) are supplied starting in the 4th cycle which is not shown. 

7. This command allows the user to swap between available Page Buffers (0 or 1). 

8. These commands reconfigure RY/BY # output to one of two pulse-modes or enable and disable the RY/BY # function. 
9. Write address, WA, is the Destination address in the flash array which must match the Source address in the Page Buffer. 
Refer to the 28F016SA User’s Manual. 

10. BCL = OOH corresponds to a Byte count of 1. Similarly, WCL = OOH corresponds to a Word count of 1. 


4.5 Compatible Status Register 
emer. 2 RBS “es et Owe. Coe Pea! eure en ae | 
7 6 5 4 3 2 1 0 


NOTES: 

WRITE STATE MACHINE STATUS RY/BY # output or WSMS bit must be checked to 

1 = Ready determine completion of an operation (Erase Suspend, 

0 = Busy Erase or Data Write) before the appropriate Status bit 
(ESS, ES or DWS) is checked for success. 


ERASE-SUSPEND STATUS 
1 = Erase Suspended 
0 = Erase in Progress/Completed 


ERASE STATUS | lf DWS and ES are set to “1” during an erase attempt, an 
1 = Error in Block Erasure improper command sequence was entered. Clear the 


0 = Successful Block Erase CSR and attempt the operation again. 


DATA-WRITE STATUS 
1 = Error in Data Write 
0 = Data Write Successful 


Vpp STATUS The VPPS bit, unlike an A/D converter, does not provide 
1 = Vpp Low Detect, Operation continuous indication of Vpp level. The WSM interrogates 
Abort Vpp’s level only after the Data-Write or Erase command 
0 = Vpp OK sequences have been entered, and informs the system if 
Vpp has not been switched on. VPPS is not guaranteed to 
report accurate feedback between Vpp,_ and Vppy. 


CSR.2-0 = RESERVED FOR FUTURE ENHANCEMENTS 
These bits are reserved for future use; mask them out when polling the CSR. 
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4.6 Global Status Register 
[wems | oss | 00s | oss | os | Peas | Pes | PBSS 
7 6 5 4 3 2 1 0 


NOTES: 
WRITE STATE MACHINE STATUS [1] RY/BY # output or WSMS bit must be 
1 = Ready checked to determine completion of an 
0 = Busy operation (Block Lock, Suspend, any RY/BY # 
reconfiguration, Upload Status Bits, Erase or 
Data Write) before the appropriate Status bit 
(OSS or DOS) is checked for success. 


OPERATION SUSPEND STATUS 
1 = Operation Suspended 
= Operation in Progress/Completed 


DEVICE OPERATION STATUS 

1 = Operation Unsuccessful 

0 = Operation Successful or Currently 
Running 


DEVICE SLEEP STATUS 
1 = Device in Sleep 
0 = Device Not in Sleep 


MATRIX 5/4 


00 = Operation Successful or Currently If operation currently running, then GSR.7 = 0. 
Running If device pending sleep, then GSR.7 = 0. 

01 Device in Sleep Mode or Pending Sleep 

10 = Operation Unsuccessful 

11 = Operation Unsuccessful or Aborted Operation aborted: Unsuccessful due to Abort 

command. 


QUEUE STATUS 
1 = Queue Full 
0 = Queue Available 


PAGE BUFFER AVAILABLE STATUS 
1 = One or Two Page Buffers Available The device contains two Page Buffers. 
0 = No Page Buffer Available 


PAGE BUFFER STATUS 

1 = Selected Page Buffer Ready 

0 = Selected Page Buffer Busy Selected Page Buffer is currently busy with 
WSM operation 

PAGE BUFFER SELECT STATUS 

1 = Page Buffer 1 Selected 

0 = Page Buffer 0 Selected 


NOTE: 
1. When multiple operations are queued, checking BSR.7 only provides indication of completion for that particular block. 
GSR.7 provides indication when all queued operations are completed. 


( 
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4.7 Block Status Register 
po OSes | oes] wos: Boas, | cos) [eoners ce Pee 
7 6 5 4 oS. 2 1 0 


NOTES: 
BLOCK STATUS [1] RY/BY # output or BS bit must be checked to 
= Ready determine completion of an operation (Block Lock, 
0 = Busy Suspend, Erase or Data Write) before the appropriate 
Status bits (BOS, BLS) is checked for success. 


BLOCK-LOCK STATUS 
1 = Block Unlocked for Write/Erase 
= Block Locked for Write/Erase 


BLOCK OPERATION STATUS 

1 = Operation Unsuccessful 

0 = Operation Successful or 
Currently Running 


BLOCK OPERATION ABORT STATUS 
1 = Operation Aborted The BOAS bit will not be set until BSR.7 = 1. 


0 = Operation Not Aborted 


MATRIX 5/4 
00 = Operation Successful or 
Currently Running 
= Nota Valid Combination 
Operation Unsuccessful 


= Operation Aborted Operation halted via Abort command. 


QUEUE STATUS 
1 = Queue Full 
0 = Queue Available 


Vpp STATUS 
1 = Vpp Low Detect, Operation Abort 
0 = Vpp OK 


NOTES: | 

BSR.1-0 = RESERVED FOR FUTURE ENHANCEMENTS 

These bits are reserved for future use; mask them out when polling the BSRs. 

1. When multiple operations are queued, checking BSR.7 only provides indication of completion for that particular block. 
GSR.7 provides indication when all queued operations are completed. 
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5.0 ELECTRICAL SPECIFICATIONS NOTICE: This data sheet contains information on 
products in the sampling and initial production phases 
of development. The specifications are subject to 


5.1 Absolute Maximum Ratings* change without notice. Verify with your local Intel 
Sales office that you have the latest data sheet be- 
Temperature Under Bias ............ 0°C to + 80°C fore finalizing a design. 


Storage Temperature .......... — 65°C to + 125°C * WARNING: Stressing the device beyond the “Absolute 
Maximum Ratings” may cause permanent damage. 
These are stress ratings only. Operation beyond the 
“Operating Conditions” is not recommended and ex- 
tended exposure beyond the “Operating Conditions” 
may affect device reliability. 


Vec = 3.3V + 0.3V Systems(5) 


[symbot| Parameter [Notes] win | Wax [Unita] Test Conalione 
Tx | Operating Temperature, commercial | 1 | 0 | 70 | “C | AnbientTemperature 
vos | VoowihRespectiognd | 2 |-oafrofv[ 
[Vee | Vee Supply Votage with Respect to GNO| 2.9 


V Voltage on any Pin (except Voc, Vpp) 
with Respect to GND 
[|__| Current into any Non-Supply Pin i en: Recah terete wea 


og 
(2) 
tn © 
3|3 
3/3] <|< 


Test Conditions 


Be 
was 
ete 
in 
To | 70 | °c | Ambient Temperature 
02 
ae 
mr 
ace 


Operating Temperature, Commercial 

Vcc with Respect to GND 

Vpp Supply Voltage with Respect to GND 
V 


ts | 
a i 
| 28 | ee aaa Sic sinks 
i = ll 
with Respect to GND 
idee aS 
=e 


Current into any Non-Supply Pin 
Output Short Circuit Current 


NOTES: 

1. Operating temperature is for commercial product defined by this specification. 

2. Minimum DC voltage is —0.5V on input/output pins. During transitions, this level may undershoot to —2.0V for periods 
<20 ns. Maximum DC voltage on input/output pins is Vcc + 0.5V which, during transitions, may overshoot to Voc + 2.0V 
for periods <20 ns. 

3. Maximum DC voltage on Vpp may overshoot to + 14.0V for periods <2Ons. 

4. Output shorted for no more than one second. No more than one output shorted at a time. 

5. AC specifications are valid at both voltage ranges. See DC Characteristics tables for voltage range-specific specifications. 
6. 5% Voc specifications refer to the 28F016SA-70 in its High Speed Test configuration. 
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5.2 Capacitance 


For a 3.3V System: 


Typ | Max | Units | TestConditions 


Cin Capacitance Looking into an pF | Ta = 25°C, f = 1.0 MHz 
Address/Control Pin 


Cout Capacitance Looking into an Output Pin 1 | 12 | pF Ta = 25°C, f = 1.0 MHz 
CLoap | Load Capacitance Driven by Outputs 1 pF | ForVcoc = 3.3V + 0.3V 
for Timing Specifications 
Equivalent Testing Load Circuit 502 transmission 
line delay 


For a 5.0V System: 


[Parameter [Note | Typ | wax] Units | Test Gonaitions 


Cin Capacitance Looking into an pF | Ta = 25°C, f = 1.0 MHz 
Address/Control Pin 


Cout Capacitance Looking into an Output Pin Se eee Ss Ta = 25°C, f = 1.0 MHz 
CLoap | Load Capacitance Driven by Outputs 100 | pF For Voc = 5.0V + 0.5V 
for Timing Specifications / 30 | pF For Voc = 5.0V + 0.25V 
Equivalent Testing Load Circuit for 252. transmission 
Voc + 10% line delay 
Equivalent Testing Load Circuit for 832 transmission 
Voc + 5% line delay 


NOTE: 
1. Sampled, not 100% tested. 
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5.3 Timing Nomenclature 


All 3.3V system timings are measured from where signals cross 1.5V. 
For 5.0V systems use the standard JEDEC cross point definitions. 
Each timing parameter consists of 5 characters. Some common examples are defined below: 


tce _ teLaqv time(t) from CE# (E) going low (L) to the outputs (Q) becoming valid (V) 

toe __tatav time(t) from OE # (G) going low (L) to the outputs (Q) becoming valid (V) 

tacc tavav time(t) from address (A) valid (V) to the outputs (Q) becoming valid (V) 

tas tavwu time(t) from address (A) valid (V) to WE# (W) going high (H) 

tpH — twHpx time(t) from WE# (W) going high (H) to when the data (D) can become undefined (X) 


Pin Characters Pin States 
Address Inputs 


Data Inputs 


CE # (Chip Enable) Driven, but not necessarily valid 
OE # (Output Enable) High Impedance 


RP # (Deep Power-Down Pin) 
RY/BY # (Ready Busy) 
Any Voltage Level 
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> TEST POINTS < OUTPUT 


290489-4 
AC test inputs are driven at Voy (2.4 VTTL) for a Logic “1” and Voc, (0.45 VTTL) for a Logic “0”. Input timing begins 
at Vip (2.0 VTTL) and Vj, (0.8 VTTL). Output timing ends at Vj and Vj. Input rise and fall times (10% to 90%) < 10 
ns. 


Figure 5. Transient Input/Output Reference Waveform (Vcc = 5.0V) 
for Standard Test Configuration(1) 


INPUT 1.5 q———= TEST POINTS ———»> 


290489-5 
AC test inputs are driven at 3.0V for a Logic “1” and 0.0V for a Logic “0”. Input timing begins, and output timing 
ends, at 1.5V. Input rise and fall times (10% to 90%) < 10 ns. 


Figure 6. Transient Input/Output Reference Waveform (Vcc = 3.3V) 
High Speed Reference Waveform(2) (Vcc = 5.0V + 5%) 


NOTES: 
1. Testing characteristics for 28F016SA-080/28F016SA-100. 
2. Testing characteristics for 28F016SA-070/28F016SA-120/28F016SA-150. 
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2.5 ns of 252 Transmission Line 


From Output 
Under Test 


290489-6 
Total Capacitance = 100 pF 


Figure 7. Transient Equivalent Testing Load Circuit (Vcc = 5.0V) » 


2.5 ns of 502 Transmission Line 


From Output 
Under Test 


290489-7 


Total Capacitance = 50 pF 


Figure 8. Transient Equivalent Testing Load Circuit (Vcc = 3.3V) 


2.5 ns of 832. Transmission Line 


From Output 
Under Test 


290489-8 


Total Capacitance = 30 pF 


Figure 9. High Speed Transient Equivalent Testing Load Circuit (Vcc = 5.0V + 5%) 
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5.4 DC Characteristics 
Voc = 3.3V + 0.3V, Ta = 0°C to + 70°C 
3/5# = Pin Set High for 3.3V Operations 


Input Load Current 


Output Leakage 
Current 


Voc Standby Current : 
locp Voc Deep Power-Down 1 
Current 


CEg#, CE, #, RP#, = Voc + 0.2V 
BYTE#, WP#, 3/5# = Voc t 
0.2V or GND + 0.2V 


Voc = Vcc Max, 
CEg#, CE, #, RP# = Vip 


locr1 Voc Read Current 


Voc Read Current | 1,4,5 


Voc Write Current 
ICCE Voc Block Erase 1 
Current 
ICcES Voc Erase Suspend 1,2 
Current 


Vpp Standby Current 


Vpp Deep Power-Down 1 
Current 


CMOS: CEp#, CE; # = GND + 0.2V 
BYTE# = GND + 0.2Vor Vcc + 0.2V 
Inputs = GND + 0.2V or 

Voc + 0.2V, 

TTL: CEg#, CE, # = Vi, 

BYTE# = Vi or Vin 
Inputs = Vj, or Vip, 

f = 8 MHz, lout = OMA 


CMOS: CEp#, CE; # = 
GND + 0.2V, BYTE# = Voc 
+ 0.2V or GND + 0.2V 
Inputs = GND + 0.2V or 
Voc + 0.2V, 

TTL: CEg#, CE, # = Vi, 
BYTE# = Vior Vi, 
Inputs = Vj, or Vip, 

f = 4MHz, lout = OMA 


ie ise tal Block Erase in Progress | 
mA | CEo#,CE,# = Viq | 
Block Erase Suspended 
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5.4 DC Characteristics (Continued) 
Voc = 3.3V + 0.3V, Ta = 0°C to +70°C 
3/5# = Pin Set High for 3.3V Operations 


'Symbol| Parameter | Notes|_Min__| Typ | Max | Units|___TestConditions 
[lepr__| VpReadCurent | 1 | 65 | | 200 | uA | Vep>Voo 


Vpp Write Current mA | Vpp = Vppu, 

Word/Byte Write in Progress 
Vpp Erase Current mA | Vpp = Vppu, 

Block Erase in Progress 
Vpp Erase Suspend pA | Vpp = Vppx, 
ee cae Erase et ae 


Vit | Input Low | Input Low Voltage 


a Tee 


Output Low Voltage Voc = Vcc Min and 
lo. = 4mA 


Vou Output High Voltage lon = —2.0mA 
Voc = Vcc Min 
Von2 sem 0.2 al = —100 eee Oe 
sce Min 
VPPL Vpp during Normal 
Operations 
VppH Vpp during Write/ 
Erase Operations : 
VLKO Voc Erase/Write V 
Lock Voltage 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Vcc = 3.3V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (package and speeds). 

2. IccEs is specified with the device de-selected. If the device is read while in erase suspend mode, current draw is the sum 
of Icces and Iccr. 

3. Block Erases, Word/Byte Writes and Lock Block operations are inhibited when Vpp = Vpp, and not guaranteed in the 
range between Vppy and Vpp,. 

4. Automatic Power Savings (APS) reduces Iccr to less than 1 mA in static operation. 

5. CMOS Inputs are either Voc + 0.2V or GND + 0.2V. TTL Inputs are either Vi, or Vip. 
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5.5 DC Characteristics 
Voc = 5.0V + 0.5V, Ta = 0°C to + 70°C 
3/5# Pin Set Low for 5V Operations 


Input Load 
Current 

Output Leakage 
Current 


| Max | Units Test Conditions 

= pA Voc = Vcc Max 
Vin = Voc or GND 
= 


0 pA Voc = Voc Max 
Vin = Voc or GND 
i Vec = Vcc Max 


Ne 
ILo 


1 
1,5 


locs Voc Standby 
Current 


CEg#, CE, #, RP# = Voc t+ 
0.2V 

BYTE#, WP#, 3/5# = Voc + 
0.2V or GND + 0.2V 


Voc = Voc Max 

CEp#, CE; #, RP# = Vip 
BYTE#, WP#, 3/5# = Viyor 
VIL 


RP# = GND + 0.2V 


Vcc Deep 
Power-Down 
Current 


Voc Read 1, 4, 
Current 


lccp 


oa 


Vcc = Vcc Max, 

CMOS: CEp#, CE; # = GND + 0.2V 
BYTE# = GND + 0.2Vor Vcc + 0.2V 
Inputs = GND + 0.2V or 

Voc + 0.2V, 

TTL: CEg#, CE, # = Vi, 

BYTE# = Vi, or Vin 

Inputs = Vj, or Vip, 

f = 10 MHz, loyt = OMA 


Voc Read 1,4,5 Voc = Vcc Max, 

CMOS: CEp#, CE; # = 
GND + 0.2V 

BYTE# = Vcc + 0.2Vor 
GND + 0.2V 

Inputs = GND + 0.2V or 
Voc + 0.2V 

TTL: CEg#, CE, # = Vi, 
BYTE# = Viyor Vic 
Inputs = Vi or Vip, 

f = 5 MHz, lout = OMA 


Bei bel es Sa Block Erase in Progress 
ICcES Voc Erase 10 mA CEp#, CE, # = Vin 
Suspend Current Block Erase Suspended 
Vpp Standby 2 of +10 pA Vpp < Voc 
Current 
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Iccr1 


Iccr2 


Current 


Iocw Voc Write 
Current 


ICCE Voc Block 
Erase Current 
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5.5 DC Characteristics (Continued) 
Voc = 5.0V + 0.5V, Ta = 0°C to + 70°C 
3/5# Pin Set Low for 5V Operations 


[symbot | Parameter | Notes 
= i 
Down Current 
ae 
Vpp = VpPH 


Ippw Vpp Write Current 
Word/Byte Write in Progress 
Vpp Block Erase Vpp = VppyH 
Current Block Erase in Progress 
Vpp Erase Suspend Vpp = VppH 
Current 


Block Erase Suspended 
Input Low Voltage 
Input High Voltage 


Output Low Voltage Voc = Vcc Min 
lo. = 5.8mA 


loH = —~2.5mA 
Voc = Vcc Min 


lon = —100 pA 
Voc = Vcc Min 


VPPH Vpp during Erase/ 
Write Operations 

VLKO Voc Erase/Write 
Lock Voltage 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Vcc = 5.0V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (package and speeds). 

2. Icces is specified with the device de-selected. If the device is read while in erase suspend mode, current draw is the sum 
of Icces and Iccr. 

3. Block Erases, Word/Byte Writes and Lock Block operations are inhibited when Vpp = Vpp, and not guaranteed in the 
range between Vppy and Vpp_. 

4. Automatic Power Saving (APS) reduces Iccr to less than 2 mA in Static operation. 

5. CMOS Inputs are either Voc + 0.2V or GND + 0.2V. TTL Inputs are either Vj, or Vip. 


VPPL Vpp during Normal 
Operations 
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5.6 AC Characteristics—Read Only Operations(1) 
Voc = 3.3V + 0.3V Ta = 0° to +70°C 


Versions (4) 


| Symbol — Parameter 
tavav 


tavav Read Cycle Time 
taVEL Address Setup to 
CE # Going Low 
tAVGL Address Setup to 
OE # Going Low 


28F016SA-120 


Notes 
120 


Address to Output Delay 120 
CE # to Output Delay 120 


RP # High to Output Delay 
OE # to Output Delay 
CE # to Output in Low Z 
CE # to Output in High Z 
OE # to Output in Low Z 
OE # to Output in High Z 


Output Hold from Address, 
CE # or OE# Change, 
Whichever Occurs First 
BYTE # to Output Delay 

tFHQV 

tFLQz BYTE# Lowto Output _ 
in High Z 

tELFL CE # Low to BYTE# 

tELFH High or Low 


oi 
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5.6 AC Characteristics—Read Only Operations(") (Continued) 


Voc = 5.0V + 0.5V, Ta = 0°C to +70°C 
Suess. reed 
Versions(4) o> ee 
28F016SA-080(6) | 28F016SA-10066) 
Parameter | Min | Max _| 
tavaAv Read Cycle Time 


taVEL Address Setup 
to CE# Going 
Low 


28F016SA-070(5) 


70 


Address Setup 
to OE # Going 
Low 


tavav Address to 
Output Delay 

tELQV CE # to Output 
Delay 

tpHOQV RP # to Output 
Delay 


tAVGL 


oO 


oO 


t6Lav OE # to Output 
Delay 

tELQX CE # to Output 
in Low Z 

tEHQZ CE # to Output 
in High Z 

t6Lax OE # to Output 
in Low Z 


tGHaOz OE # to Output 
in High Z 
Output Hold 
from Address, 
CE# or OE# 
Change, 
Whichever 
Occurs First 


tFLaV BYTE# to 
tFHQV Output Delay 
tFLQz BYTE# Low to 
Output in High Z 
CE # Low to 
BYTE # High or 
Low 


=) 


tELFL 
tELFH 


NOTES: 


1. See AC Input/Output Reference Waveforms for timing measurements, Figures 5 and 6. 

2. OE # may be delayed up to te_qy-teLoy after the falling edge of CE # without impact on teLav. 
3. Sampled, not 100% tested. 

4. Device Speeds are defined as: 


70/80 ns at Vcc = 5.0V equivalent to 


120 ns at Voc = 3.3V 
100 ns at Voc = 5.0V equivalent to 
150 ns at Voc = 3.3V 


5. See AC Input/Output Reference Waveforms and AC Testing Load Circuits for High Speed Test Configuration. 
6. See Standard AC Input/Output Reference Waveforms and AC Testing Load Circuit. 
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DEVICE AND 
iar vl ADDRESS SELECTION 


ADDRESSES 0 XXXXXXXM ADDRESSES STABLE 
IL 


Vin 


CEx# (E) 61) 


DATA (D/Q) 
Vor 


NOTE: 


OUTPUTS ENABLED STANDBY 


Voge POWER-DOWN 


XI 


DATA VALID 


290489-9 


1. CE, # is defined as the latter of CEg# or CE; # going Low or the first of CEg # or CE; # going High. 


Figure 10. Read Timing Waveforms 
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BAN 


BYTE# (F) 
Vit 


Vou 


af fs i 4 pata \. \ A _ dich z 
DATA (DQ0-DQ7) DATA OUTPUT 
a a. OUTPUT aa" 


Von trLoz 


DATA (DQ8-0Q15) Prac DATA ome HIGH Z 
ae OUTPUT 


Vor 


290489-10 


NOTE: 
1. CE, # is defined as the latter of CEg# or CE; # going Low or the first of CEg# or CE; # going High. 


Figure 11. BYTE# Timing Waveforms 
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5.7 Power-Up and Reset Timings 


Voc POWER UP 


RP# 
(P) 


Voc 
OV 


(3V,5V) 


Address 
cs) DARA CX MAXA MAA AAAS VALID 
t avav 
y. 
(RR SS at 5.0V OUTPUTS 
tpHav 


290489-12 


Figure 12. Vcc Power-Up and RP # Reset Waveforms 


tpHav RP # High to Data Valid for 
Voc = 5V + 10% 


NOTES: 
CEg#, CE; # and OE# are switched low after Power-Up. 


1. Minimum of 2 ys is required to meet the specified tpyay times. 

2. The power supply may start to switch concurrently with RP # going Low. 

3. The address access time and RP# high to data valid time are shown for 5V Vcc operation. Refer to the AC Characteris- 
tics Read Only Operations 3.3V Voc operation and all other speed options. : 
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5.8 AC Characteristics for WE #—Controlled Command Write Operations(1) 
Voc = 3.3V + 0.3V Ta = 0°C to +70°C 


Sa ee ee ee, um 
[Symbol | Parameter | Notes | Min | Typ | Max| Min | Typ | Max 
Tava |Witecycetme ——*«|~—s«t wot | sit veo] || ne 
Tivewn | Ver SetuptowE@ GongHign | a | 100] | | 100, | | ne 
‘tov, | RP# Setup oCE# Gongiow | | 40] | | 40| | | ne 
‘term. | CE* Setup ower Gongiow || 10 | | | 10] | | ne 
Gl a Bd Se 
Going High 

‘tov | DataSetuptowe#GoingHigh | 26 | 75 | | | 75 | | | ns 
‘tmwH |WE#Pulsewidth = | | 75 | || 5 | ns 
Ttwuox | DataHordtromwWee rin | 2 || | || | | ne 
[twiax | AddressHoldfromWe#High | 2 | to | | | 10 | | | ns 
twHen | CE#Holdtromwe# High | | to | | | to | | ns 
Se? PE 


WE # High to RY/BY # Going Low 
tRHPL RP # Hold from Valid Status 
Register (CSR, GSR, BSR) Data 
and RY/BY # High 
tPHWL RP # High Recovery to 
WE # Going Low 
Write Recovery before Read 
tov Vpp Hold from Valid Status 
Register (CSR, GSR, BSR) Data 
and RY/BY # High 
twHav1 | Duration of Word/Byte 
Write Operation 
twHav2 | Duration of Block 
Erase Operation 
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AC Characteristics for WE #—Controlled Command Write Operations(') (Continued) 
Voc = 5.0V + 0.5V Ta = O°C to +70°C 


pmowigunti | <-* see 
Versions 
Voc + 10% treet 28F016SA-080 28F016SA-100 


Symbol| __Parameter___|_Notes_| min | Typ | Max | Min | Typ | Max | Min | Typ | Max_ 


Ces a a ee 
tyPWH Vpp Setup to WE # Going 100 
High 
tPHEL RP# Setup to CE# Going 480 480 480 
Low 
tELWL CE # Setup to WE# Going 
Low 
taVWH Address Setup to WE # 
Going High 
tovWH Data Setup to WE # Going 
High 


twiwH | WE# Pulse Width 
twHDx Data Hold from WE # High 


tWHAX Address Hold from WE # 
High 


CE # Hold from WE # High 
twHwL | WE# Pulse Width High 


tGHWL Read Recovery before 
Write 


tWHRL WE # High to RY/BY # 
Going Low 


RP# Hold from Valid 
Status Register (CSR, 
GSR, BSR) Data and RY/ 


tRHPL 


BY # High 


tPpHWL RP# High Recovery to 
WE # Going Low 


tWHGL Write Recovery before 
Read 


Vpp Hold from Valid Status 
Register (CSR, GSR, BSR) 


tavv 


Data and RY/BY # High 


twHav1 | Duration of Word/Byte 
Write Operation 


twHav2 | Duration of Block Erase 
Operation 


NOTES: 
CE # is defined as the latter of CEg# or CE; # going Low or the first of CEg # or CE; # going High. 


1. Read timings during write and erase are the same as for normal read. 

2. Refer to command definition tables for valid address and data values. 

3. Sampled, but not 100% tested. 

4. Write/Erase durations are measured to valid Status Register (CSR) Data. 

5. Word/Byte write operations are typically performed with 1 Programming Pulse. 

6. Address and Data are latched on the rising edge of WE# for all Command Write operations. 
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WRITE VALID ADDRESS 
& DATA (DATA-WRITE) OR 
ERASE CONFIRM COMMAND 


DEEP WRITE DATA-WRITE OR 
POWER-DOWN | ERASE SETUP COMMAND 
View VV % YY 


F) VV 
Vn DVR 


AUTOMATED DATA-WRITE WRITE READ EXTENDED READ EXTENDED 
OR ERASE DELAY REGISTER COMMAND STATUS REGISTER DATA 


pana KKK) AKYXKY KKK) KKK) 
NOTE 1 eatarelelltetats x YY Ry 


READ COMPATIBLE 
STATUS REGISTER DATA 


NOTE 3 } XX 


(x Vi, 
XY 


aoonesses (a) "" RXX\AXTXERRRRRRY EY AXXXXERREN 
RAINY OAK RKYY OX 


XY 
NOTE 2 Vin PXXX) % 


KKK) 
YY 


tavav t wHax 


CEx# (E) 
NOTE 4 


DATA (D/Q) 


RY/BY# (R) 


VppH # XX XXX XX XX XX XXX Kae A / KXKXXK KKK XXXKKKKKKK KK 
mn PMO, RXKXX XX AXX RX 
Yn AK 


Xx 


XXXXKX VVVY XX CR ak 
RAR KKANY 


LN ZN ZAZA LN ZN 
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NOTES: ) 

1. This address string depicts Data-Write/Erase cycles with corresponding verification via ESRD. 

2. This address string depicts Data-Write/Erase cycles with corresponding verification via CSRD. 

3. This cycle is invalid when using CSRD for verification during Data-Write/Erase operations. 

4. CE,# is defined as the latter of CEg# or CE; # going Low or the first of CEg # or CE; # going High. 
5. RP # low transition is only to show tryp_; not valid for above Read and Write cycles. 


Figure 13. AC Waveforms for Command Write Operations 
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5.9 AC Characteristics for CE #—Controlled Command Write Operations(1) 
Voc = 3.3V + 0.3V Ta = 0°C to +70°C 


Versions 28F016SA-120 28F016SA-150 


Parameter 


Write Cycle Time 

RP# Setup to WE # Going Low 
Vpp Setup to CE # Going high 
WE # Setup to CE# Going Low 


tavAV 
tPHWL 
tVPEH 
tWLEL 


tAVEH Address Setup to 


CE # Going High 

Data Setup to CE # Going High 
CE # Pulse Width 

Data Hold from CE # High 


| Notes 
a 
aa 
ae 
ial 
| 26 | 
mies 
ae 
Address Hold fromCE# High | 2 | 
ees 
was 
ae 
ro 
ani, 


tDVEH 
tELEH 
tEHDX 
tEHAX 
tEHWH 
tEHEL 


WE # Hold from CE # High 

CE # Pulse Width High 

tGHEL Read Recovery before Write 
tEHRL CE # High to RY/BY # Going Low 


tRHPL RP# Hold from Valid Status 
Register (CSR, GSR, BSR) Data 
and RY/BY # High 


tPHEL RP# High Recovery to 
CE # Going Low 


— i; 
ak | ok tik | SE] as | 
< 
ao] 
s~ 
a 


Ej 
” 


tEHGL Write Recovery before Read | 95 


tQv Vpp Hold from Valid Status ps 
Register (CSR, GSR, BSR) Data 
at RY/BY # High 
teHoQv1 Duration of Word/Byte pS 
Write Operation 
teHqv2 | Duration of Block 
Erase Operation 
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AC Characteristics for CE #—Controlled Command Write Operations(?) (Continued) 
Voc = 5.0V + 0.5V, Ta = 0° to +70° | 


C 
eee 

Voo+10%| | 28F016SA-080 | 28FO16SA-100__ 
[Symbol| __Parameter___—|_Notes_| min | Typ | Max | Min | Typ | Max | Min | Typ | Max 
i [eeoreren| otal | Tet T= 


tPpHWL RP# Setup to WE # Going 480 480 
Low 
tyPEH Vpp Setup to CE # Going 480 100 
High 
tWLEL WE # Setup to CE# Going 
Low 
taVEH Address Setup to CE # 
Going High 
toVEH Data Setup to CE # Going 
High 


teen | CE#Pusowieth || 40 ee eee 2 
tenox | DataHoldtromcee Hin | 2 | o | | | o | | flo || ns 


tEHAX Address Hold from CE # 
High 


tEHWH WE # Hold from CE # High 
tEHEL CE # Pulse Width High 


tGHEL Read Recovery before 


Write 
tEHRL CE # High to RY/BY # 100 
Going Low 


RP # Hold from Valid 
Status Register (CSR, 


tRHPL 


GSR, BSR) Data and RY/ 
BY # High 


tPHEL RP# High Recovery to 
CE # Going Low 

tEHGL Write Recovery before 

Read 

Vpp Hold from Valid Status 

Register (CSR, GSR, BSR) 


tQVVL 


Data and RY/BY # High 


teHqv1 | Duration of Word/Byte 4,5 
Write Operation 


teHaqv2 | Duration of Block Erase 
Operation 


NOTES: 
CE # is defined as the latter of CEj7# or CE; # going Low or the first of CEg# or CE; # going High. 


1. Read timings during write and erase are the same as for normal read. 

2. Refer to command definition tables for valid address and data values. 

3. Sampled, but not 100% tested. 

4. Write/Erase durations are measured to valid Status Data. 

5. Word/Byte write operations are typically performed with 1 Programming Pulse. 

6. Address and Data are latched on the rising edge of CE # for all Command Write Operations. 


ADVANCE INFORMATION 3-39 


28F016SA o intel ‘ 


DEEP WRITE DATA-WRITE OR & Pe earn Wane) ce AUTOMATED DATA-WRITE WRITE READ EXTENDED READ EXTENDED 
POWER-DOWN ERASE SETUP COMMAND ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER COMMAND STATUS REGISTER DATA 
ATTA VAVAY, VAVAVAVAVAVAVAVAVAY, VV VAT AV AV ATA AV AY, VAVAVAVAVAVAVAVAVAVAVAY, YV 
XY .9,0.9,9,9.9,0.0,0.9.0,9 


RXR) a 
nore Mn ZX OK 


OKMAXK KX) v 
KKK RY \ 
READ COMPATIBLE 
STATUS REGISTER DATA 
appresses (a) Wk RAK 


; xx KKK) : Bee Aa 9 al EX XX CHESS NOTE 3 SOECETEVE VED ES COX VVY XX XXXX) So Ny 
note 2 Yn DRY OY RR aR OA 


CEx# (E) 
NOTE 4 


DATA (D/Q) 


RY/BY# (R) 


i WAVAY, XX XX XX Y XXX Ker iy w/ "8 OX V KX XOX KX KX XX 1V, 
= ERED EEA 
Yn AXXO XXX 
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NOTES: 

1. This address string depicts Data-Write/Erase cycles with corresponding verification via ESRD. 

2. This address string depicts Data-Write/Erase cycles with corresponding verification via CSRD. 

3. This cycle is invalid when using CSRD for verification during Data-Write/Erase operations. 

4. CE, # is defined as the latter of CE) # or CE; # going Low or the first of CEg# or CE; # going High. 
5. RP # low transition is only to show trRyp_; not valid for above Read and Write cycles. 


Figure 14. Alternate AC Waveforms for Command Write Operations 
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5.10 AC Characteristics for Page Buffer Write Operations(") 
Voc = 3.3V + 0.3V Ta = 0°C to +70°C. 


eet ee ee eee 
Tavay [wiiedyoetie | [iol | |wm[ | [mm 
Pew | 0€¢ setpiowes Gongiw [| |} w] | [mm 
Fawn | Adress Setup toWEs Gongiow | [0 | | | o[ || mm 
Pow | DataSenptowee congtin [2 | {| |] | | ns 
Pam [wee rucowan | fw t | || | [mm 
Pwo | DataHoittromweerignh | 2 || | |] 
Pax | Adress Hold tom Wee High [2 
Pwien | OE@ Hold tom WE High | 
. — 
“Sa LB 
aaa 


WE # Pulse Width High 
Read Recovery before Write 
Write Recovery before Read 


Voc = 5.0V + 0.5V, Ta = 0°C to +70°C 


28F016SA-070 28F016SA-080 28F016SA-100 
Write Cycle Time 


tELWL CE # Setup to 
WE # Going Low 
taVWL Address Setup to 
WE # Going Low 
toVWH Data Setup to 2 
WE # Going High 
1 


WE # Pulse Width 


tWHDx Data Hold from 
WE # High 

tWHAX Address Hold 10 
from WE # High 


twHEH | CE# Hold from 10 
WE # High 

twHwL | WE# Pulse Width 
High 


tGHWL Read Recovery 
before Write 
twHGL | Write Recovery 
before Read 


NOTES: 

CE # is defined as the latter of CEg# or CE; # going Low or the first of CEg# or CE; # going High. 
1. These are WE #-controlled write timings, equivalent CE #-controlled write timings apply. 

2. Sampled, but not 100% tested. 

3. Address must be valid during the entire WE # Low pulse. 
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Figure 15. Page Buffer Write Timing Waveforms 
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5.11 Erase and Word/Byte Write Performance(s) 
Voc = 3.3V + 0.3V Ta = 0°C to +70°C 


[symbot | Parameter | Notes 
Ciwinnt | Worvenewietine | 2 | | 9 
Cimien2 | Blockwitetime | 2 | | 06 
iwinn® | BlockwiteTime | 2 | | 0a 
abies ee a 
amie C2 | | ae 


units | Test Gonaitions _ 
ei! ee 
—s 
sec 


Word Write Mode 


Block Erase Time 


Full Chip Erase Time 


[ symbol | Parameter | Notes 
Ciwinnt | Word Byte/witeTine | 2 
iwunne | BlookwteTine | 2 
nieus | Block ite Time | 2 
P| Blok EreoTine | 2 
ao wr 


Full Chip Erase Time 


| Units | Test Conditions 
ee 
| Sec | Byte Write Mode 


NOTES: 

1. 25°C, Vpp = 12.0V. 

2. Excludes System-Level Overhead. 

3. These performance numbers are valid for all speed versions. 
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6.0 DERATING CURVES 


ined cl Ser ocd aa Oe 
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=e 
See ae 
a? ims 
-L)}~ 85°C 
= ¢ 
ATE 
Pei ae 
0 2 4 6 8 ia. tay tar 4 


FREQUENCY (MHz) 


= 
< 
= 
— 
= 
mo] 
= 
° 
= 
~ 
a 
Ss) 
=>) 


locr (Word) (mA) 


FREQUENCY (MHz) 
290489-19 


Figure 16. icc vs Frequency (Vcc = 5.5V) 
for x8 or x16 Operation Figure 17. Ilcc vs Frequency (Vcc = 3.6V) 
for x8 or x16 Operation 
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Figure 18. Ilcc during Block Erase 
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5 mA/div 
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100 ms/div 
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Figure 19. Ipp during Block Erase 


Access Time (ns) 


100 


Output Load Capacitance (pF) 


290489-24 


Figure 20. Access Time (tacc) vs Output Loading 
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Figure 21. Ilpp during Word Write Operation Figure 22. Ipp during Page Buffer Write Operation 


3-46 ADVANCE INFORMATION 


intel | Ay 28F016SA 


7.0 MECHANICAL SPECIFICATIONS 


oO 
z 
= 
< 
ld 
n" 


SEE DETAIL A 
| pete. 


DETAIL B DETAIL A 


ale: lao 
poe ay 


Figure 23. Mechanical Specifications of the 28F016SA 56-L-TSOP Type 1 Package 
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Family: Thin Small Outline Package 
Millimeters 
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DEVICE NOMENCLATURE 


E = Standard ACCESS SPEED (ns) 


56-Lead TSOP 70ns (5V, 30pF), 80ns (5V), 120ns (3.3V) 


100ns (5V), 150ns (3.3V) | 
290489-—29 


Voc = 3.3V + 0.3V Vcc = 5.0V + 10% Voc = 5.0V + 5%, 30 pF 
E28F016SA-120 E28F016SA-080 E28F016SA-070 
E28F016SA-150 Berge, eee ge | 


ADDITIONAL INFORMATION 
Order 
Number 


System Optimization Using the Enhanced Features of the 28F016SA 292127 
28F016SA Software Drivers 292126 


Upgrade Considerations trom the 28FO08SA to the 28F016SA 292124 
ETOX IV Flash Memory Technology—Insight to Intel’s Fourth Generation Process 294016 
Innovation 

DD28F032SA Data Sheet 290490 


28F008SA Data Sheet 290435 


DATASHEET REVISION HISTORY 


eee. a Description 
Bae Cae Original Version 
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PRELIMINARY 


28F008SA 
8-MBIT (1-MBIT x 8) FLASHFILET™’ MEMORY 


High-Density Symmetrically Blocked 
Architecture 
— Sixteen 64-Kbyte Blocks 


Extended Cycling Capability 

— 100,000 Block Erase Cycles 

— 1.6 Million Block Erase 
Cycles per Chip 


Automated Byte Write and Block Erase 
— Command User Interface 
— Status Register 


System Performance Enhancements 
— RY/BY# Status Output 
— Erase Suspend Capability 


Deep-Powerdown Mode 
— 0.20 2A Icc Typical 


Very High-Performance Read 
— 85 ns Maximum Access Time 


SRAM-Compatible Write Interface 


Hardware Data Protection Feature 
— Erase/Write Lockout during Power 
Transitions 


industry Standard Packaging 
— 40-Lead TSOP, 44-Lead PSOP 


ETOX Ill Nonvolatile Flash Technology 
— 12V Byte Write/Block Erase 


independent Software Vendor Support 


— Microsoft* Flash File System (FFS) 


Intel’s 28FOO8SA 8-Mbit FlashFile™ Memory is the highest density nonvolatile read/write solution for solid 
state storage. The 28FO08SA’s extended cycling, symmetrically blocked architecture, fast access time, write 
automation and low power consumption provide a more reliable, lower power, lighter weight and higher per- 
formance alternative to traditional rotating disk technology. The 28FO08SA brings new capabilities to portable 
computing. Application and operating system software stored in resident flash memory arrays provide instant- 
on, rapid execute-in-place and protection from obsolescence through in-system software updates. Resident 
software also extends system battery life and increases reliability by reducing disk drive accesses. 


For high density data acquisition applications, the 28FOO8SA offers a more cost-effective and reliable alterna- 
tive to SRAM and battery. Traditional high density embedded applications, such as telecommunications, can 
take advantage of the 28FOO8SA’s nonvolatility, blocking and minimal system code requirements for flexible 
firmware and modular software designs. 


The 28FO08SA is offered in 40-lead TSOP (standard and reverse) and 44-lead PSOP packages. Pin assign- 
ments simplify board layout when integrating multiple devices in a flash memory array or subsystem. This 
device uses an integrated Command User Interface and state machine for simplified block erasure and byte 
write. The 28FOO8SA memory map consists of 16 separately erasable 64-Kbyte blocks. 


Intel’s 28FOO8SA employs advanced CMOS circuitry for systems requiring low power consumption and noise 
immunity. Its 85 ns access time provides superior performance when compared with magnetic storage media. 
A deep powerdown mode lowers power consumption to 1 wW typical thru Vcc, crucial in portable computing, 
handheld instrumentation and other low-power applications. The RP# power control input also provides 


absolute data protection during system powerup/down. 


Manufactured on Intel’s 0.8 micron ETOX process, the 28FO0O8SA provides the highest levels of quality, 
reliability and cost-effectiveness. 


*Microsoft is a trademark of Microsoft Corporation. 


October 1993 
Order Number: 290429-004 


3-49 


28F008SA 


PRODUCT OVERVIEW 


The 28F008SA is a_ high-performance 8-Mbit 
(8,388,608 bit) memory organized as 1 Mbyte 
(1,048,576 bytes) of 8 bits each. Sixteen 64-Kbyte 
(65,536 byte) blocks are included on the 28FO08SA. 
A memory map is shown in Figure 6 of this specifica- 
tion. A block erase operation erases one of the six- 
teen blocks of memory in typically 1.6 seconds, in- 
dependent of the remaining blocks. Each block can 
be independently erased and written 100,000 cy- 
cles. Erase Suspend mode allows system software 
to suspend block erase to read data or execute 
code from any other block of the 28FOO8SA. 


The 28F008SA is available in the 40-lead TSOP 
(Thin Small Outline Package, 1.2 mm thick) and 44- 
lead PSOP (Plastic Small Outline) packages. Pin- 
outs are shown in Figures 2 and 4 of this specifica- 
tion. 


The Command User Interface serves as the inter- 
face between the microprocessor or microcontroller 
and the internal operation of the 28FOO8SA. 


Byte Write and Block Erase Automation allow 
byte write and block erase operations to be execut- 
ed using a two-write command sequence to the 
Command User Interface. The internal Write State 
Machine (WSM) automatically executes the algo- 
rithms and timings necessary for byte write and 
block erase operations, including verifications, 
thereby unburdening the microprocessor or micro- 
controller. Writing of memory data is performed in 
byte increments typically within 9 ys, an 80% im- 
provement over current flash memory products. Ipp 
byte write and block erase currents are 10 mA 
typical, 30 mA maximum. Vpp byte write and 
block erase voltage is 11.4V to 12.6V. 
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The Status Register indicates the status of the 


WSM and when the WSM successfully completes 


the desired byte write or block erase operation. 


The RY/BY # output gives an additional indicator of 
WSM activity, providing capability for both hardware 
signal of status (versus software polling) and status 
masking (interrupt masking for background erase, 
for example). Status polling using RY/BY# mini- 
mizes both CPU overhead and system power con- 
sumption. When low, RY/BY# indicates that the 
WSM is performing a block erase or byte write oper- 
ation. RY/BY # high indicates that the WSM is ready 
for new commands, block erase is suspended or the 
device is in deep powerdown mode. 


Maximum access time is 85 ns (tacc) over the com- 
mercial temperature range (0°C to + 70°C) and over 
Vcc supply voltage range (4.5V to 5.5V and 4.75V to 
5.25V). leg active current (CMOS Read) is 20 mA 
typical, 35 mA maximum at 8 MHz. 


When the CE# and RP# pins are at Vcc, the Icc 
CMOS Standby mode is enabled. 


A Deep Powerdown mode is enabled when the 
RP# pin is at GND, minimizing power consumption 
and providing write protection. Ic¢ current in deep 
powerdown is 0.20 A typical. Reset time of 400 ns 
is required from RP # switching high until outputs are 
valid to read attempts. Equivalently, the device has a 
wake time of 1 ws from RP# high until writes to the 
Command User Interface are recognized by the 
28F008SA. With RP# at GND, the WSM is reset 
and the Status Register is cleared. 
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Table 1. Pin Description 


Name and Function 


Ao-Ai9 INPUT ADDRESS INPUTS for memory addresses. Addresses are internally 
latched during a write cycle. 


User Interface write cycles; outputs data during memory array, Status 
Register and Identifier read cycles. The data pins are active high and 
float to tri-state off when the chip is deselected or the outputs are 

disabled. Data is internally latched during a write cycle. 


CHIP ENABLE: Activates the device’s control logic, input buffers, 
decoders, and sense amplifiers. CE # is active low; CE # high deselects 
the memory device and reduces power consumption to standby levels. 


RESET/DEEP POWERDOWN: Puts the device in deep powerdown 
mode. RP # is active low; RP # high gates normal operation. RP # also 
locks out block erase or byte write operations when active low, providing 
data protection during power transitions. RP # active resets internal 
automation. Exit from Deep Powerdown sets device to read-array mode. 


WRITE ENABLE: Controls writes to the Command User Interface and 
array blocks. WE # is active low. Addresses and data are latched on the 
rising edge of the WE # pulse. 


READY/BUSY #: Indicates the status of the internal Write State 
Machine. When low, it indicates that the WSM is performing a block 
erase or byte write operation. RY/BY # high indicates that the WSM is 
ready for new commands, block erase is suspended or the device is in 
deep powerdown mode. RY/BY # is always active and does NOT float 
to tri-state off when the chip is deselected or data outputs are disabled. 


BLOCK ERASE/BYTE WRITE POWER SUPPLY for erasing blocks of 
the array or writing bytes of each block. 

NOTE: 
With Vpp < Vpp; wax, Memory contents cannot be altered. 


DEVICE POWER SUPPLY (5V + 10%, 5V +5%) 
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Standard Pinout 


STANDARD PINOUT 
E28FOO8SA 
40 LEAD TSOP 
10mm x 20mm 
TOP VIEW 


Reverse Pinout 


REVERSE PINOUT 
F28FOO8SA 
40 LEAD TSOP 
10mm x 20mm 
TOP VIEW 


Figure 2. TSOP Lead Configurations 


28F008SA 
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Figure 4. PSOP Lead Configuration 
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80386SL PCMD# 28F008SA's 
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mune Ro# | ore 


FLSHDCS# 
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28FO08SA 
28F008SA 


82360SL 
Controller RESET# 
PWRGOOD 
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EPLD(s) 
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TO OTHER 
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PAIRS 


Figure 5. 28F008SA Array Interface to Intel386SL Microprocessor Superset through PI Bus 
(Including RY/BY # Masking and Selective Powerdown), for DRAM Backup during System SUSPEND, 
Resident O/S and Applications and Motherboard Solid-State Disk. 
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PRINCIPLES OF OPERATION 


The 28F008SA includes on-chip write automation to 
manage write and erase functions. The Write State 
Machine allows for: 100% TTL-level control inputs; 
fixed power supplies during block erasure and byte 
write; and minimal processor overhead with RAM- 
like interface timings. 


After initial device powerup, or after return from 
deep powerdown mode (see Bus Operations), the 
28F008SA functions as a read-only memory. Manip- 
ulation of external memory-control pins allow array 
read, standby and output disable operations. Both 
Status Register and intelligent identifiers can also be 
accessed through the Command User Interface 
when Vpp = Vpp. 


This same subset of operations is also available 
when high voltage is applied to the Vpp pin. In addi- 
tion, high voltage on Vpp enables successful block 
erasure and byte writing of the device. All functions 
associated with altering memory contents—byte 
write, block erase, status and intelligent identifier— 
are accessed via the Command User Interface and 
verified thru the Status Register. 


Commands are written using standard microproces- 
sor write timings. Command User Interface contents 
serve as input to the WSM, which controls the block 
erase and byte write circuitry. Write cycles also inter- 
nally latch addresses and data needed for byte write 
or block erase operations. With the appropriate com- 
mand written to the register, standard microproces- 
sor read timings output array data, access the intelli- 
gent identifier codes, or output byte write and block 
erase status for verification. 


Interface software to initiate and poll progress of in- 
ternal byte write and block erase can be stored in 
any of the 28FOO8SA blocks. This code is copied to, 
and executed from, system RAM during actual flash 
memory update. After successful completion of byte 
write and/or block erase, code/data reads from the 
28FO008SA are again possible via the Read Array 
command. Erase suspend/resume capability allows 
system software to suspend block erase to read 
data and execute code from any other block. 


PRELIMINARY 


28F008SA 


Figure 6. Memory Map 


Command User Interface and Write 
Automation 


An on-chip state machine controls block erase and 
byte write, freeing the system processor for other 
tasks. After receiving the Erase Setup and Erase 
Confirm commands, the state machine controls 
block pre-conditioning and erase, returning progress 
via the Status Register and RY/BY# output. Byte 
write is similarly controlled, after destination address 
and expected data are supplied. The program and 
erase algorithms of past Intel flash memories are 
now regulated by the state machine, including pulse 
repetition where required and internal verification 
and margining of data. 
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Data Protection 


Depending on the application, the system designer 
may choose to make the Vpp power supply switcha- 
ble (available only when memory byte writes/block 
erases are required) or hardwired to Vppy. When 
Vpp = Vpp._, memory contents cannot be altered. 
The 28FOO8SA Command User Interface architec- 
ture provides protection from unwanted byte write or 
block erase operations even when high voltage is 
applied to Vpp. Additionally, all functions are dis- 
abled whenever Vcc is below the write lockout volt- 
age Vixo, or when RP# is at Vi,. The 28FOO8SA 
accommodates either design practice and encour- 
ages optimization of the processor-memory inter- 
face. 


The two-step byte write/block erase Command User 
Interface write sequence provides additional soft- 
ware write protection. 


BUS OPERATION 


Flash memory reads, erases and writes in-system 
via the local CPU. All bus cycles to or from the flash 
memory conform to standard microprocessor bus 
cycles. 


Read 


The 28F008SA has three read modes. The memory 
can be read from any of its blocks, and information 
can be read from the intelligent identifier or Status 
Register. Vpp can be at either Vpp, or Vppp. 


intel. 


The first task is to write the appropriate read mode 
command to the Command User Interface (array, in- 
telligent identifier, or Status Register). The 
28F008SA automatically resets to Read Array mode 
upon initial device powerup or after exit from deep 
powerdown. The 28F008SA has four control pins, 
two of which must be logically active to obtain data 
at the outputs. Chip Enable (CE #) is the device se- 
lection control, and when active enables the select- 
ed memory device. Output Enable (OE #) is the data 
input/output (DQ9>-DQ7) direction control, and when 
active drives data from the selected memory onto 
the 1/O bus. RP# and WE# must also be at Vj. 
Figure 10 illustrates read bus cycle waveforms. 


Output Disable 


With OE # at a logic-high level (Vj), the device out- 
puts are disabled. Output pins (DQ 9-DQ7) are 
placed in a high-impedance state. 


Standby 


CE# ata logic-high level (Vj) places the 28FOO08SA 
in standby mode. Standby operation disables much 
of the 28FOO8SA’s circuitry and substantially reduc- 
es device power consumption. The outputs (DQo- 
DQ7) are placed in a high-impedence state indepen- 
dent of the status of OE #. If the 28FO08SA is dese- 
lected during block erase or byte write, the device 
will continue functioning and consuming normal ac- 
tive power until the operation completes. 


Table 2. Bus Operations 


Write 


NOTES: 


Vin | Yu | vw | Mu | x | x | Ow | x | 


1. Refer to DC Characteristics. When Vpp = Vpp_, memory contents can be read but not written or erased. 
2. X can be Vi, or Viq for control pins and addresses, and Vpp, or Vppy for Vpp. See DC Characteristics for Vpp_ and Vppy 


voltages. 


3. RY/BY # is Vo, when the Write State Machine is executing internal block erase or byte write algorithms. It is Voy when 
the WSM is not busy, in Erase Suspend mode or deep powerdown mode. 
4. Command writes involving block erase or byte write are only successfully executed when Vpp = Vppy. 


5. Refer to Table 3 for valid Diy during a write operation. 
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Deep Power-Down 


The 28FO08SA offers a deep power-down feature, 
entered when RP # is at Vj. Current draw thru Voc 
is 0.20 pA typical in deep power-down mode, with 
current draw through Vpp typically 0.1 wA. During 
read modes, RP#-low deselects the memory, 
places output drivers in a high-impedence state and 
turns off all internal circuits. The 28FOO8SA requires 
time tpyqy (see AC Characteristics-Read-Only Op- 
erations) after return from powerdown until initial 
memory access outputs are valid. After this wakeup 
interval, normal operation is restored. The Com- 
mand User Interface is reset to Read Array, and the 
upper 5 bits of the Status Register are cleared to 
value 10000, upon return to normal operation. 


During block erase or byte write modes, RP# low 
will abort either operation. Memory contents of the 
block being altered are no longer valid as the data 
will be partially written or erased. Time tpyw_ after 
RP# goes to logic-high (Vj) is required before an- 
other command can be written. 


This use of RP# during system reset is important 
with automated write/erase devices. When the sys- 
tem comes out of reset it expects to read from the 
flash memory. Automated flash memories provide 
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status information when accessed during write/ 
erase modes. If a CPU reset occurs with no flash 
memory reset, proper CPU initialization would not 
occur because the flash memory would be providing 
the status information instead of array data. Intel’s 
Flash Memories allow proper CPU initialization fol- 
lowing a system reset through the use of the RP# 
input. In this application RP# is controlled by the 
same RESET # signal that resets the system CPU. 


intelligent Identifier Operation 


The intelligent identifier operation outputs the manu- 
facturer code, 89H; and the device code, A2H for 
the 28FO08SA. The system CPU can then automati- 
cally match the device with its proper block erase 
and byte write algorithms. 


The manufacturer- and device-codes are read via 
the Command User Interface. Following a write of 
90H to the Command User Interface, a read from 
address location OOOOOH outputs the manufacturer 
code (89H). A read from address 00001H outputs 
the device code (A2H). It is not necessary to have 
high voltage applied to Vpp to read the intelligent 
identifiers from the Command User Interface. 


Table 3. Command Definitions 


Byte Write Setup/Write 


Alternate Byte Write Setup/Write 


NOTES: 
1. Bus operations are defined in Table 2. 


Bus 
Operation | Address | Data| Operation | Address | Data 


a | oe 
fae4] wite 
3 | wite [x |70H| reed | x [Ao 
[wie [x [sot | 
m2 | write 
[| wite [x [eon | wite [x [oon 
[28.8] wite | wa | aon | wite | wa | wo. 
[2.8.5] wite | wa |toH| wite | wa [wo 


First Bus Cycle | Second Bus Cycle 


Tx [oon] Read [A | 00 


Tea [on | wits | ea [bon 


2. |A = Identifier Address: OOH for manufacturer code, 01H for device code. 


BA = Address within the block being erased. 
WA = Address of memory location to be written. 


3. SRD = Data read from Status Register. See Table 4 for a description of the Status Register bits. 
WD = Data to be written at location WA. Data is latched on the rising edge of WE #. 


liD = Data read from Intelligent Identifiers. 


4. Following the Intelligent Identifier command, two read operations access manufacture and device codes. 
5. Either 40H or 10H are recognized by the WSM as the Byte Write Setup command. 
6. Commands other than those shown above are reserved by Intel for future device implementations and should not be 


used. 
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Write 


Writes to the Command User Interface enable read- 
ing of device data and Intelligent Identifiers. They 
also control inspection and clearing of the Status 
Register. Additionally, when Vpp = Vppy, the Com- 
mand User Interface controls block erasure and byte 
write. The contents of the interface register serve as 
input to the internal state machine. 


The Command User Interface itself does not occupy 
an addressable memory location. The interface reg- 
ister is a latch used to store the command and ad- 
dress and data information needed to execute the 
command. Erase Setup and Erase Confirm com- 
mands require both appropriate command data and 
an address within the block to be erased. The Byte 
Write Setup command requires both appropriate 
command data and the address of the location to be 
written, while the Byte Write command consists of 
the data to be written and the address of the loca- 
tion to be written. 


The Command User Interface is written by bringing 
WE# to a logic-low level (Vi) while CE# is low. 
Addresses and data are latched on the rising edge 
of WE#. Standard microprocessor write timings are 
used. 


Refer to AC Write Characteristics and the AC Wave- 
forms for Write Operations, Figure 11, for specific 
timing parameters. 


COMMAND DEFINITIONS 


When Vpp, is applied to the Vpp pin, read opera- 
tions from the Status Register, intelligent identifiers, 
or array blocks are enabled. Placing Vppy on Vpp 
enables successful byte write and block erase oper- 
ations as well. 


Device operations are selected by writing specific 
commands into the Command User Interface. Table 
3 defines the 28FOO8SA commands. 


Read Array Command 


Upon initial device powerup and after exit from deep 
powerdown mode, the 28FO08SA defaults to Read 
Array mode. This operation is also initiated by writing 
FFH into the Command User Interface. Microproces- 
sor read cycles retrieve array data. The device re- 
mains enabled for reads until the Command User 
Interface contents are altered. Once the internal 
Write State Machine has started a block erase or 
byte write operation, the device will not recognize 
the Read Array command, until the WSM has com- 
pleted its operation. The Read Array command is 
functional when Vpp = Vpp, or Vppp. 


Table 4. Status Register Definitions 


7 6 5 4 3 2 1 0 


” 

DD 

N 
I 


WRITE STATE MACHINE STATUS 
Ready 

Busy 

ERASE SUSPEND STATUS 
Erase Suspended 

Erase in Progress/Completed 
ERASE STATUS 

Error in Block Erasure 
Successful Block Erase 
BYTE WRITE STATUS 

Error in Byte Write 
Successful Byte Write 


Vpp STATUS 
Vpp Low Detect; Operation Abort 

O = Vpp OK 
SR.2-SR.0 = RESERVED FOR FUTURE 

ENHANCEMENTS 

These bits are reserved for future use and 
should be masked out when polling the Status 
Register. 


I il 


” 
D 


7) 
Be) 


4 
0 
6 
1 
0 
5 
i= 
@) — 
" 
; 
0 
3 
1 
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NOTES: 


RY/BY # or the Write State Machine Status bit must first 
be checked to determine byte write or block erase com- 
pletion, before the Byte Write or Erase Status bit are 
checked for success. 


If the Byte Write AND Erase Status bits are set to “1’’s 
during a block erase attempt, an improper command se- 
quence was entered. Attempt the operation again. 


If Vpp low status is detected, the Status Register must be 
cleared before another byte write or block erase opera- 
tion is attempted. 


The Vpp Status bit, unlike an A/D converter, does not 
provide continuous indication of Vpp level. The WSM in- 
terrogates the Vpp level only after the byte write or block 
erase command sequences have been entered and in- 
forms the system if. Vpp has not been switched on. The 
Vpp Status bit is not guaranteed to report accurate feed- 
back between Vpp, and Vppy. 
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intelligent Identifier Command 


The 28F008SA contains an Intelligent Identifier op- 
eration, initiated by writing 90H into the Command 
User Interface. Following the command write, a read 
cycle from address OOOOOH retrieves the manufac- 
turer code of 89H. A read cycle from address 
00001H returns the device code of A2H. To termi- 
nate the operation, it is necessary to write another 
valid command into the register. Like the Read Array 
command, the Intelligent Identifier command is func- 
tional when Vpp = Vpp, or Vppy. 


Read Status Register Command 


The 28FO08SA contains a Status Register which 
may be read to determine when a byte write or block 
erase operation is complete, and whether that oper- 
ation completed successfully. The Status Register 
may be read at any time by writing the Read Status 
Register command (70H) to the Command User In- 
terface. After writing this command, all subsequent 
read operations output data from the Status Regis- 
ter, until another valid command is written to the 
Command User Interface. The contents of the 
Status Register are latched on the falling edge of 
OE# or CE#, whichever occurs last in the read cy- 
cle. OE# or CE# must be toggled to Vj before 
further reads to update the Status Register latch. 
The Read Status Register command functions when 


Vpp = VppL Or VppH. 


Clear Status Register Command 


The Erase Status and Byte Write Status bits are set 
to “1”’s by the Write State Machine and can only be 
reset by the Clear Status Register Command. These 
bits indicate various failure conditions (see Table 4). 
By allowing system software to control the resetting 
of these bits, several operations may be performed 
(such as cumulatively writing several bytes or eras- 
ing multiple blocks in sequence). The Status Regis- 
ter may then be polled to determine if an error oc- 
curred during that sequence. This adds flexibility to 
the way the device may be used. 


Additionally, the Vpp Status bit (SR.3) MUST be re- 
set by system software before further byte writes or 
block erases are attempted. To clear the Status 
Register, the Clear Status Register command (50H) 
is written to the Command User Interface. The Clear 
Status Register command is functional when Vpp = 


VppL Or VppH.- 


Erase Setup/Erase Confirm 
Commands 


Erase is executed one block at a time, initiated by a 
two-cycle command sequence. An Erase Setup 
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command (20h) is first written to the Command User 
Interface, followed by the Erase Confirm command 
(DOH). These commands require both appropriate 
sequencing and an address within the block to be 
erased to FFH. Block preconditioning, erase and 
verify are all handled internally by the Write State 
Machine, invisible to the system. After the two-com- 
mand erase sequence is written to it, the 28FO08SA 
automatically outputs Status Register data when 
read (see Figure 8; Block Erase Flowchart). The 
CPU can detect the completion of the erase event 
by analyzing the output of the RY/BY# pin, or the 
WSM Status bit of the Status Register. 


When erase is completed, the Erase Status bit 
should be checked. If erase error is detected, the 
Status Register should be cleared. The Command 
User Interface remains in Read Status Register 
mode until further commands are issued to it. 


This two-step sequence of set-up followed by execu- 
tion ensures that memory contents are not acciden- 
tally erased. Also, reliable block erasure can only 
occur when Vpp = Vppy. In the absence of this high 
voltage, memory contents are protected against era- 
sure. If block erase is attempted while Vpp = Vpp,, 
the Vpp Status bit will be set to “1”. Erase attempts 
while Vpp_ < Vpp < Vppy produce spurious results 
and should not be attempted. 


Erase Suspend/Erase Resume 
Commands 


The Erase Suspend command allows block erase 
interruption in order to read data from another block 
of memory. Once the erase process starts, writing 
the Erase Suspend command (BOH) to the Com- 
mand User Interface requests that the WSM sus- 
pend the erase sequence at a predetermined point 
in the erase algorithm. The 28FO08SA continues to 
output Status Register data when read, after the 
Erase Suspend command is written to it. Polling the 
WSM Status and Erase Suspend Status bits will de- 
termine when the erase operation has been sus- 
pended (both will be set to 1”). RY/BY# will also 
transition to Vox. 


At this point, a Read Array command can be written 
to the Command User Interface to read data from 
blocks other than that which is suspended. The only 
other valid commands at this time are Read Status 
Register (70H) and Erase Resume (DOH), at which 
time the WSM will continue with the erase process. 
The Erase Suspend Status and WSM Status bits of 
the Status Register will be automatically cleared and 
RY/BY # will return to Vo,. After the Erase Resume 
command is written to it, the 28FOO8SA automatical- 
ly outputs Status Register data when read (see Fig- 
ure 9; Erase Suspend/Resume Flowchart). Vpp 
must remain at Vppy while the 28FOO8SA is in Erase 
Suspend. 
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Byte Write Setup/Write Commands 
(40H or 10H) 


Byte write is executed by a two-command sequence. 
The Byte Write Setup command (40H or 10H) is writ- 
ten to the Command User Interface, followed by a 
second write specifying the address and data 
(latched on the rising edge of WE#) to be written. 
The WSM then takes over, controlling the byte write 
and write verify algorithms internally. After the two- 
command byte write sequence is written to it, the 
28F008SA automatically outputs Status Register 
data when read (see Figure 7; Byte Write Flowchart). 
The CPU can detect the completion of the byte write 
event by analyzing the output of the RY/BY # pin, or 
the WSM Status bit of the Status Register. Only the 
Read Status Register command is valid while byte 
write is active. 


When byte write is complete, the Byte Write Status 
bit should be checked. If byte write error is detected, 
the Status Register should be cleared. The internal 
WSM verify only detects errors for ‘‘1’’s that do not 
successfully write to ‘0’”’s. The Command User In- 
terface remains in Read Status Register mode until 
further commands are issued to it. If byte write is 
attempted while Vpp = Vpp,, the Vpp Status bit will 
be set to “1”. Byte write attempts while Vpp, < Vpp 
< Vppy produce spurious results and should not be 
attempted. 


EXTENDED BLOCK ERASE/BYTE 
WRITE CYCLING 


Intel has designed extended cycling capability into 
its ETOX flash memory technologies. The 
28F008SA is designed for 100,000 byte write/block 
erase cycles on each of the sixteen 64-Kbyte 
blocks. Low electric fields, advanced oxides and 
minimal oxide area per cell subjected to the tunnel- 
ing electric field combine to greatly reduce oxide 
stress and the probability of failure. A 20-Mbyte sol- 
id-state drive using an array of 28FOO8SAs has a 
MTBF (Mean Time Between Failure) of 33.3 million 
hours(1), over 600 times more reliable than equiva- 
lent rotating disk technology. 


AUTOMATED BYTE WRITE 


The 28FO08SA integrates. the Quick-Pulse program- 
ming algorithm of prior Intel Flash devices on-chip, 
using the Command User Interface, Status Register 
and Write State Machine (WSM). On-chip integration 
dramatically simplifies system software and provides 
processor interface timings to the Command User 
Interface and Status Register. WSM operation, inter- 
nal verify and Vpp high voltage presence are moni- 
tored and reported via the RY/BY # output and ap- 
propriate Status Register bits. Figure 7 shows a 


arr ke 
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system software flowchart for device byte write. The 
entire sequence is performed with Vpp at Vppy. Byte 
write abort occurs when RP # transitions to Vj,, or 
Vpp drops to Vpp,. Although the WSM is halted, 
byte data is partially written at the location where 
byte write was aborted. Block erasure, or a repeat of 


byte write, is required to initialize this data to a 
known value. 


AUTOMATED BLOCK ERASE 


As above, the Quick-Erase algorithm of prior Intel 
Flash devices is now implemented internally, includ- 
ing all preconditioning of block data. WSM opera- 
tion, erase success and Vpp high voltage presence 
are monitored and reported through RY/BY# and 
the Status Register. Additionally, if a command other 
than Erase Confirm is written to the device following 
Erase Setup, both the Erase Status and Byte Write 
Status bits will be set to “1s. When issuing the 
Erase Setup and Erase Confirm commands, they 
should be written to an address within the address 
range of the block to be erased. Figure 8 shows a 
system software flowchart for block erase. 


Erase typically takes 1.6 seconds per block. The 
Erase Suspend/Erase Resume command sequence 


~ allows suspension of this erase operation to read 


data from a block other than that in which erase is 
being performed. A system software flowchart is 
shown in Figure 9. 


The entire sequence is performed with Vpp at Vppy. 
Abort occurs when RP # transitions to Vi, or Vpp 
falls to Vpp,, while erase is in progress. Block data is 
partially erased by this operation, and a repeat of 
erase is required to obtain a fully erased block. 


DESIGN CONSIDERATIONS 


Three-Line Output Control 


The 28F008SA will often be used in large memory 
arrays. Intel provides three control inputs to accom- 
modate multiple memory connections. Three-line 
control provides for: 


a) lowest possible memory power dissipation 


b) complete assurance that data bus contention will 
not occur 


To efficiently use these control inputs, an address 
decoder should enable CE#, while OE# should be 
connected to all memory devices and the system’s 
READ # control line. This assures that only selected 
memory devices have active outputs while deselect- 
ed memory devices are in Standby Mode. RP# 
should be connected to the system Powergood sig- 
nal to prevent unintended writes during system pow- 
er transitions. Powergood should also toggle during 
system reset. 


(1)Assumptions: 10-Kbyte file written every 10 minutes. (20-Mbyte array)/(10-Kbyte file) = 2,000 file writes before erase required. 
(2000 files writes/erase) < (100,000 cycles per 28FOO8SA block) = 200 million file writes. 
(200 x 106 file writes) < (10 min/write) < (1 hr/60 min) = 33.3 x 106 MTBF. 
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RY/BY # and Byte Write/Block Erase 28F008SA, and returns to Voy when the WSM has 
Polling finished executing the internal algorithm. 


RY/BY # is a full CMOS output that provides ahard- | RY/BY# can be connected to the interrupt input of 

ware method of detecting byte write and block erase the system CPU or controller. It is active at all times, 

completion. It transitions low time twHRL after a not tristated if the 28F008SA CE# or OE# inputs 

write or erase command sequence is written to the | are brought to Vij. RY/BY# is also Voy when the 

| : device is in Erase Suspend or deep powerdown 
modes. 


Bus 
Operation 


Write 40H (10H), Byte Write | Data = 40H (10H) 


Byte Address Setup Address = Byte to be written 


Write Byte Byte Write | Data to be written 
Address/Data Address = Byte to be written 


r 


Standby/Read Check RY/BY # 
VoH = Ready, Vo_ = Busy 
or 
Read Status Register 
. Check SR.7 
Full Status 1 = Ready, 0 = Busy 
eneak.\t Saree Toggle OE # or CE# to 
update Status Register 


-Byte Write Repeat for subsequent bytes 


Completed 
290429-6 Full status check can be done after each byte or after a 
sequence of bytes 


Write FFH after the last byte write operation to reset the 
device to Ready Array Mode 


FULL STATUS CHECK PROCEDURE Bus 
Command Comments 
Operation 
Status Register Data Optional CPU may already have read 


Ready polling above 


Error 1 = Vpp Low Detect 
RARE Standby Check SR.4 


SR.3 MUST be cleared, if set during a byte write attempt, 
¥E before further attempts are allowed by the Write State 
Machine. 


S 
Successful SR.4 is only cleared by the Clear Status Register Command, 


290429-7 in cases where multiple bytes are written before full status is 
checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 7. Automated Byte Write Flowchart 
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Bus 
Operation [Command | Comments 
Data = 20H 
Write 20H, lied 
Address = Within block to be 
erased 
Write DOH, Data = DOH 
Block Address Address = Within block to be 


erased 
Erase Suspend 

Standby/Read Check RY/BY # 

Von = Ready, Vo_ = Busy 
or 

Read Status Register 
Check SR.7 
1 = Ready, 0 = Busy 
Toggle OE # or CE# to 
update Status Register 


Repeat for subsequent bytes 


Full status check can be done after each block or after a 
290429-8 sequence of blocks 


Write FFH after the last block erase operation to reset the 
device to Ready Array Mode 


Pe ee option | Command | Comments 
Command Comments 
Operation 


Optional CPU may already have read 
Read Status Register data in WSM 
Ready polling above 


Vpp Range Standby Check SR.3 
Error 1 = Vpp Low Detect 


Both 1 = Command Sequence 


Error 


Block Erase 
Standby Check SR.5 


= Block Erase Error 
SR.3 MUST be cleared, if set during a block erase attempt, 


YES 
before further attempts are allowed by the Write State 
Block Erase : 
es ae 
Successful 


290429-9 SR.5 is only cleared by the Clear Status Register 
Command, in cases where multiple blocks are erased 
before full status is checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 8. Automated Block Erase Flowchart 
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Write BOH 


Write 70H 


Read Status 
Register 


of 


S 0 


Erase Has 
YES Completed 


Write FFH 


Done 
Reading? 


of 


=< 
m 
” 


Write DOH 


Continue Erase 
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Standby/ 
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=e Command Comments 
Operation 


Erase Data = BOH 


Suspend 


Read 
Status Register 


Data = 70H 


Check RY/BY # 

VOH = Ready, VoL = 
Busy or Read Status 
Register 


Read 


Check SR.7 

1 = Ready, 0 = Busy 
Toggle OE # or CE# to 
Update Status Register 


Check SR.6 
1 = Suspended 


Standby 


Read Array Data = FFH 


Read array data from block 
other than that being 
erased. 


Erase Resume | Data = DOH 


Figure 9. Erase Suspend/Resume Flowchart 


Power Supply Decoupling 


Flash memory power switching characteristics re- 
quire careful device decoupling. System designers 
are interested in 3 supply current issues; standby 
current levels (Isp), active current levels (Icc) and 
transient peaks produced by falling and rising edges 
of CE#. Transient current magnitudes depend on 
the device outputs’ capacitive and inductive loading. 
Two-line control and proper decoupling capacitor 
selection will suppress transient voltage peaks. 
Each device should have a 0.1 j4F ceramic capacitor 
connected between each Vcc and GND, and be- 
tween its Vpp and GND. These high frequency, low 
inherent-inductance capacitors should be placed as 
close as possible to package leads. Additionally, for 
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every 8 devices, a 4.7 pF electrolytic capacitor 
should be placed at the array’s power supply con- 
nection between Vcc and GND. The bulk capacitor 
will overcome voltage slumps caused by PC board 
trace inductances. 


Vpp Trace on Printed Circuit Boards 


Writing flash memories, while they reside in the tar- 
get system, requires that the printed circuit board 
designer pay attention to the Vpp power supply 
trace. The Vpp pin supplies the memory cell current 
for writing and erasing. Use similar trace widths and 
layout considerations given to the Vcc power bus. 
Adequate Vpp supply traces and decoupling will de- 
crease Vpp voltage spikes and overshoots. 
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Vcc; Vpp, RP # Transitions and the 
Command/Status Registers 


Byte write and block erase completion are not guar- 
anteed if Vpp drops below Vppy. If the Vpp Status bit 
of the Status Register (SR.3) is set to 1”, a Clear 
Status Register command MUST be issued before 
further byte write/block erase attempts are allowed 
by the WSM. Otherwise, the Byte Write (SR.4) or 
Erase (SR.5) Status bits of the Status Register will 
be set to “1’’s if error is detected. RP # transitions to 
Vii during byte write and block erase also abort the 
operations. Data is partially altered in either case, 
and the command sequence must be repeated after 
normal operation is restored. Device poweroff, or 
RP# transitions to Vj,, clear the Status Register to 
initial value 10000 for the upper 5 bits. 


The Command User Interface latches commands as 
issued by system software and is not altered by Vpp 
or CE# transitions or WSM actions. Its state upon 
powerup, after exit from deep powerdown or after 
Vcc transitions below V; Ko, is Read Array Mode. 


After byte write or block erase is complete, even 
after Vpp transitions down to Vpp,, the Command 
User Interface must be reset to Read Array mode via 
the Read Array command if access to the memory 
array is desired. 


Power Up/Down Protection 


The 28F008SA is designed to offer protection 
against accidental block erasure or byte writing dur- 
ing power transitions. Upon power-up, the 
28F008SA is indifferent as to which power supply, 
Vpp or Vcc, powers up first. Power supply sequenc- 
ing is not required. Internal circuitry in the 28FOO8SA 
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ensures that the Command User Interface is reset to 
the Read Array mode on power up. 


A system designer must guard against spurious 
writes for Voc voltages above ViKo when Vpp is 
active. Since both WE# and CE# must be low for a 
command write, driving either to Vjy will inhibit 
writes. The Command User Interface architecture 
provides an added level of protection since altera- 
tion of memory contents only occurs after success- 
ful completion of the two-step command sequences. 


Finally, the device is disabled until RP # is brought to 
Vin, regardless of the state of its control inputs. This 
provides an additional level of memory protection. 


Power Dissipation 


When designing portable systems, designers must 
consider battery power consumption not only during 
device operation, but also for data retention during 
system idle time. Flash nonvolatility increases us- 
able battery life, because the 28FOO8SA does not 
consume any power to retain code or data when the 
system is off. 


In addition, the 28FOO8SA’s deep powerdown mode 
ensures extremely low power dissipation even when 
system power is applied. For example, portable PCs 
and other power sensitive applications, using an ar- 
ray of 28FOO8SAs for solid-state storage, can lower 
RP# to Vi, in standby or sleep modes, producing 
negligable power consumption. If access to the 
28FO008SA is again needed, the part can again be 
read, following the tpyaqy and tpyw._ wakeup cycles 
required after RP# is first raised back to Vjy. See 
AC Characteristics—Read-Only and Write Opera- 
tions and Figures 10 and 11 for more information. 
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ABSOLUTE MAXIMUM RATINGS* 


Operating Temperature 


NOTICE: This data sheet contains preliminary infor- 
mation on new products in production. The specifica- 
tions are subject to change without notice. Verify with 


DING FAGGG: ccc nwete tenes aees 0°C to + 70°C(1) your local Intel Sales office that you have the latest 
During Block Erase/Byte Write ....0°C to + 70°C data sheet before finalizing a design. 
Temperature Under Bias......... — 10°C to + 80°C *WARNING: Stressing the device beyond the “Absolute 
Storage Temperature .......... —65°C to +125°C ‘Maximum Ratings” may cause permanent damage. 
These are stress ratings only. Operation beyond the 
Voltage on Any Pin “Operating Conditions” is not recommended and ex- 
(except Vcc and Vpp) tended exposure beyond the “Operating Conditions” 
with Respect to GND TeTTLTe —2.0V to + 7.0V(2) may affect device reliability. 


Vpp Program Voltage with 
Respect to GND during 
Block Erase/Byte Write ...—2.0V to + 14.0V(2, 3) 


Voc Supply Voltage 

with Respect toGND ........ —2.0V to + 7.0V(2) 
Output Short Circuit Current............. 100 mA(4) 
NOTES: 


1. Operating temperature is for commercial product defined by this specification. 

2. Minimum DC voltage is —0.5V on input/output pins. During transitions, this level may undershoot to —2.0V for periods 
<20 ns. Maximum DC voltage on input/output pins is Voc + 0.5V which, during transitions, may overshoot to Vcc + 2.0V 
for periods <20 ns. 

3. Maximum DC voltage on Vpp may overshoot to + 14.0V for periods <20 ns. 

4. Output shorted for no more than one second. No more than one output shorted at a time. 

5. 5% Vcc specifications reference the 28FO008SA-85 in its High Speed configuration. 10% Voc specifications reference the 
28F008SA-85 in its Standard configuration, and the 28FOO8SA-120. 


OPERATING CONDITIONS 


Operating Temperature 


Voc Supply Voltage (10%) 
Voc Supply Voltage (5%) 


DC CHARACTERISTICS 


|Symbol | ___Parameter___| Notes | Min | Typ | Max | Unit | __—Test Condition 
lo Input Load Current 1 +1.0 | pA | Voc = Voc Max 
Vin = Voc or GND 
ILo +10 | pA | Voc = Voc Max 
Vout = Vcc or GND 
Iccs A 


100 | pA | Voc = Voc Max 
CE# = RP# = Vcc +0.2V 
pA | RP# = GND +0.2V 
lout (RY/BY #) = OmA 


f = 8 MHz, lout = OmA 
CMOS Inputs 


m Voc = Voc Max 
CE# = RP# = Vip 
locp Vcc Deep PowerDown 1 
Current 


lccr | Voc Read Current ae 
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f = 8 MHz, lout = OmA 
TTL Inputs 
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DC CHARACTERISTICS (Continued) 


locw Vcc Byte Write Current 
ICCE Vcc Block Erase Current 


Icces Vcc Erase Suspend Current 


1 
1 


Min 
a 
ee 
a 


1 


Vpp Standby Current 


a oe Block Erase Suspended 
CE# = Vin 
| 90 


Vpp Deep PowerDown 1 
Current 

IPpw Vpp Byte Write Current 1 
Vpp Block Erase Current 1 


30 mA | Vpp = VpPH 
Byte Write in Progress 
Vpp Erase Suspend 1 
Current 


30 mA | Vpp = VppyH 
Block Erase in Progress 
A | Vpp = VppH 
Block Erase Suspended 


Input Low Voltage 


Input High Voltage 


Output Low Voltage 


ViL 

VIH 

VOL 
OH 


lo. = 5.8mA 
V Output High Voltage Voc = Vcc Min 
lon = —2.5mA 


VPPL Vpp during Normal 
Operations 

VppyH Vpp during Erase/Write © 
Operations . 


VLKO Voc Erase/Write Lock 
Voltage 


2. 


2) 


Input Capacitance 
Output Capacitance 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Voc = 5.0V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (packages and speeds). 

2. Icces is specified with the device deselected. If the 28FOO8SA is read while in Erase Suspend Mode, current draw is the 
sum of Icces and Iccr. . 

3. Includes RY/BY #. 

4. Block Erases/Byte Writes are inhibited when Vpp = Vpp_ and not guaranteed in the range between Vppy and Vpp,. 

5. Sampled, not 100% tested. 
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AC INPUT/OUTPUT REFERENCE WAVEFORM(') AC TESTING LOAD CIRCUIT(") 


2.4 
2.0 2.0 
INPUT Sst POINTS =. OUTPUT 
0.8 0.8 
0.45 


290429-11 


DEVICE 


UNDER 
TEST 


CL. = 100 pF 
C, Includes Jig 


Capacitance 290429-12 
R_ = 3.3 ko 


AC test inputs are driven at Voy (2.4 Vrt_) for a Logic “1” and Voc, (0.45 Vr7_) for a Logic 
“0”. Input timing begins at Viy (2.0 Vr7_) and Vi, (0.8 Vr). Output timing ends at Vi and 
ViL- Input rise and fall times (10% to 90%) < 10 ns. 


HIGH SPEED ? HIGH SPEED 
AC INPUT/OUTPUT REFERENCE WAVEFORM(2) AC TESTING LOAD CIRCUIT(2) 


3.0 = = (sean 
INPUT 1.5 <——— _ TEST POINTS, ————_> 2 1.5 OUTPUT 
0.0 


AC test inputs are driven at 3.0V for a Logic “1” and 0.0V for a Logic “0”. Input timing 
begins, and output timing ends, at 1.5V. Input rise and fall times (10% to 90%) < 10 ns. 


DEVICE 
UNDER 
TEST 


C,_ = 30 pF 
C, Includes Jig 


Capacitance 290429-18 
Rp = 3.3 kn 


290429-17 


NOTES: 
1. Testing characteristics for 28FOO8SA-85 in Standard configuration, and 28FOO8SA-120. 
2. Testing characteristics for 28FOO8SA-85 in High Speed configuration. 


AC CHARACTERISTICS—Read-Only Operations(1) 


Versions 


Parameter 


tavav ‘Read Cycle Time 


tavav Address to Output Delay 
tELQV CE # to Output Delay 
t 


tpHav RP# High to Output Delay 
tGLav OE # to Output Delay 
tELaQx CE # to Output Low Z 
tEHQZ CE# High to Output High Z 
tGLax OE # to Output Low Z 

to 


Z 
tGHaz OE # High to Output High Z 


H Output Hold from 
Addresses, CE# or OE# 
Change, Whichever is First 


NOTES: 

1. See AC Input/Output Reference Waveform for timing measurements. 

2. OE# may be delayed up to tce-tog after the falling edge of CE# without impact on tce. 

3. Sampled, not 100% tested. 

4. See High Speed AC Input/Output Reference Waveforms and High Speed AC Testing Load Circuits for testing characteris- 
tics. 

5. See AC Input/Output Reference Waveforms and AC Testing Load Circuits for testing characteristics. 
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Suo}}es9dO peoy 10} WUOJOARM OV ‘O| e4NBi4 


ADDRESSES (A) Oe An a “LYK 


Vin 


DEVICE AND 
ADDRESS SELECTION OUTPUTS ENABLED 


ADDRESSES STABLE 


teLav 
teLax 
teLax 


DATA VALID 


VALID OUTPUT 


STANDBY Veg POWER-DOWN 


MXXXK KKK 
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AC CHARACTERISTICS—Write Operations(‘) 


zerossaes | | 
Versions 

Vect10% | ____—_—_—~|-20F008SA-est®) | 2aFO0eSA-12008) 
 tavav _| Write Cycle Time 


tPpHWL RP# High Recovery to 
WE # Going Low 

teLwL | tcs CE # Setup to WE # Going 
ace 4 


twp WE # | WE# Pulse Width Width 


tvpwH | tvps | Vpp Setup to WE# Going 
High 


nse Data Hold from WE # High 


tWHAX Address Hold from WE # 
High 


CE # Hold from WE # High 
WE # Pulse Width High 


tWHRL WE # High to RY/BY # 
Going Low 


twHav2 Duration of Block Erase 
Operation 
tWHGL Write Recovery before 
Read 
tvpH | Vpp Hold from Valid SRD, 
RY/BY # High 


NOTES: 

1. Read timing characteristics during erase and byte write operations are the same as during read-only operations. Refer to 
AC Characteristics for Read-Only Operations. 

2. Sampled, not 100% tested. 

3. Refer to Table 3 for valid Ajj for byte write or block erasure. 

4. Refer to Table 3 for valid Dix for byte write or block erasure. 

5. The on-chip Write State Machine incorporates all byte write and block erase system functions and overhead of standard 
Intel flash memory, including byte program and verify (byte write) and block precondition, precondition verify, erase and 
erase verify (block erase). 

6. Byte write and block erase durations are measured to completion (SR.7 = 1, RY/BY# = Von). Vpp should be held at 
VppyH until determination of byte write/block erase success (SR.3/4/5 = 0) 

7. See High Speed AC Input/Output Reference Waveforms and High Speed AC Testing Load Circuits for testing characteris- 
tics. 

8. See AC Input/Output Reference Waveforms and AC Testing Load Circuits for testing characteristics. 


tWHOV1 Duration of Byte Write 
Operation 
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BLOCK ERASE AND BYTE WRITE pei Aiea 


| 2BFOO8SA-85 28F008SA-120 
Parameter Notes 


Tain 
[Bockereotme it 2 || 
ae 


NOTES: 
1. 25°C, 12.0 Vpp 
2. Excludes Bienen Overhead. 
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Voc POWER-UP WRITE BYTE WRITE OR VALID ADDRESS yen WRITE) AUTOMATED BYTE WRITE READ STATUS WRITE READ ARRAY 
& STANDBY ERASE SETUP COMMAND OR ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER DATA COMMAND 
V 
lH eee =. ae ee (\ XXX aX WAV, x) es \/ XXX KKK \/ Xx {X eee ee: eeeee 
pacers 5"). Gaara IA XR KRXK XK RRXKKOKOY 
tavay tavWH tWHAX 
Vi 
CE# (E) 
be teELWL tWHEH 
tWHGL 
VW 
OE# (G) 
Vi 
twHavt, 2 
Vin 
WE# (W) 
Vit al 
tovwH 
YH cH 2 E fh, \\ 
DATA (D/Q) & (ay) fy vatio (on) 
Vi SHWE tal 
tWHRL 
Vou 
RY/BY# (R) 
Vou 
Vi 
RP# (P) 
: oe i 
tovve 
VpPH y v. 
x KKKKK KKK XXKKK KK} tx KX VAY, XXX XXXXKKK KX 
ve AORN OOYY RRR RO 
1H (\ o) “KKKKKKKKKKKKKY VAVAVaVaVAaVaVAVaVAVaVaVaVaAVAVAVAVAY, 
1, LORRY selaseelateeletecoletaleten’ 
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ALTERNATIVE CE #-CONTROLLED WRITES 


zeroossaes® | | 
Versions 
28F008SA-85(7) | 28FOO08SA-120(7) 


RP # High Recovery to 
CE# Going Low 


tvpEH | tvps | Vpp Setup to CE# Going 
High 

tavEH | tas. | Address Setup to CE# 
Going High 

tovEH Data Setup to CE # pacing 
pag oer a 


EHO ton | Data Hold from CE # | Data Hold from CE# High 


High 


Soc. WE# Hold hom CE igh 


teHeL | tepy | CE# Pulse Width | CE# Pulse Width High 


tEHRL CE# High to RY/BY # 
Going Low 

tEHaV1 Duration of Byte Write ps 
Operation 

teEHQV2 Duration of Block Erase 
Operation 

tEHGL Write Recovery before ps 
Read 

tavv. | tvpH | Vpp Hold from Valid SRD, 
RY/BY # High 


NOTES: 

1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of CE# and WE#. In systems where 
CE # defines the write pulsewidth (within a longer WE # timing waveform), all setup, hold and inactive WE# times should be 
measured relative to the CE# waveform. 

2. Sampled, not 100% tested. 

3. Refer to Table 3 for valid Ajj for byte write or block erasure. 

4. Refer to Table 3 for valid Dix for byte write or block erasure. 

5. Byte write and block erase durations are measured to completion (SR.7 = 1, RY/BY# = Voy). Vpp should be held at 
Vppy until determination of byte write/block erase success (SR.3/4/5 = 0) 

6. See High Speed AC Input/Output Reference Waveforms and High Speed AC Testing Load Circuits for testing characteris- 
tics. 

7. See AC Input/Output Reference Waveforms and AC Testing Load Circuits for testing characteristics. 
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WRITE 
Voc POWER-UP WRITE BYTE WRITE OR VALID ADDRESS & DATA(BYTE WRITE) AUTOMATED BYTE WRITE READ STATUS WRITE READ ARRAY 
& STANDBY ERASE SETUP COMMAND OR ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER DATA COMMAND 


YY 


V 
; lH XY} XXX KK KKK 
mass BRO IRR 


OA AXRXRRXKX MI RXR KX RAGAN) 


# XX i\Z\ Xx 


X (xX XXX XX {\ KX / XX XX? 


tavay taVEH teHAx 
Vin 
WE# (W) 
Vit 


Vin 


Vi 
teHovi, 2 
Vi 
CE# (E) 
Vit 


Vi 
DATA (D/Q) 
Mi 


HIGH Z 


Vou 
RY /BY# (R) 


tov 

ee YY XKKK VY \Y XXX KK} ) LAN/\/ ee PETE TEE TET EH 
AXXO NXAEX AXA RXAKXRYAK 
(KY KKK KYKKKKKKKK KY UXXXXKX XX XX XX XX XXX 
POY XX KKXKKKKK 
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ORDERING INFORMATION 


et zpepefofopefsjal pels : 
PACKAGE a ACCESS SPEED (ns) 


E = STANDARD 40 LEAD TSOP 85 ns 
F = REVERSE 40 LEAD TSOP 120ns 


PA = 44 LEAD PSOP 290429-16 


VALID COMBINATIONS 
E28F008SA-85 F28F008SA-85 PA28F0085A-85 
E28F008SA-120 F28FO08SA-120 PA28F0085A-120 


ADDITIONAL INFORMATION 


Order 
Number 

28F008SA-L Datasheet 290435 

AP-359 ‘“28FO08SA Hardware Interfacing” 292094 
AP-360 “25FO08SA Software Drivers” 292095 
AP-364 “28F008SA Automation and Algorithms’ 292099 
ER-27 “The Intel 28FOO8SA Flash Memory”’ 294011 
ER-28 “ETOX Ill Flash Memory Technology” 290412 


REVISION HISTORY 


004 


Description 


Revised from Advanced Information to Preliminary 

Modified Erase Suspend Flowchart 

Removed -90 speed bin 

Integrated -90 characteristics into -85 speed bin 

Combined Vpp Standby current and Vpp Read 
current into one Vpp Standby current spec with two 
test conditions (DC Characteristics table) 

Lowered V| xo from 2.2V to 2.0V. 


PWD renamed to RP # for JEDEC standardization 
compatibility. 

Changed Ipps Standby current spec from + 10 »A to 
+ 15 A in DC Characteristics table. 
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28F008SA-L 
8-MBIT (1 MBIT x 8) FLASHFILETM MEMORY 


m@ High-Density Symmetrically Blocked 8 
Architecture 
— Sixteen 64-Kbyte Blocks 


m Low-Voltage Operation 
— —3.3V +0.3V or 5.0V +10% Vcc 


m@ Extended Cycling Capability 
— 10,000 Block Erase Cycles 
— 160,000 Biock Erase 

Cycles per Chip 


= Automated Byte Write and Block Erase 
— Command User Interface 
— Status Register eZ) 


= System Performance Enhancements 
— RY/BY# Status Output 
— Erase Suspend Capability 


Intel’s 28FOO8SA-L 8 Mbit FlashFile™’ Memory is the highest density nonvolatile read/write solution for solid 
state storage. The 28FO08SA-L’s extended cycling, symmetrically blocked architecture, fast access time, write 


High-Performance Read 
— 200 ns Maximum Access Time 


Deep-Powerdown Mode 
— 0.20 vA icc Typical 


SRAM-Compatible Write Interface 


Hardware Data Protection Feature 
— Erase/Write Lockout during Power 
Transitions 


m@ Industry Standard Packaging 


— 40-Lead TSOP, 44-Lead PSOP 


ETOX Ill Nonvolatile Flash Technology 
— 12V Byte Write/Block Erase 


automation and very low power consumption provide a more reliable, lower power, lighter weight and higher 
performance alternative to traditional rotating disk technology. The 28FOO8SA-L brings new capabilities to 
portable computing. Application and operating system software stored in resident flash memory arrays provide 
instant-on,, rapid execute-in-place and protection from obsolescence through in-system software updates. 
Resident software also extends system battery life and increases reliability by reducing disk drive accesses. 


For high density data acquisition applications, the 28FOO8SA-L offers a more cost-effective and reliable alter- 
native to SRAM and battery. Traditional high density embedded applications, such as telecommunications, can 
take advantage of the 28FOO8SA-L’s nonvolatility, blocking and minimal system code requirements for flexible 


firmware and modular software designs. 


The 28F008SA-L is offered in 40-lead TSOP (standard and reverse) and 44-lead PSOP packages. Pin assign- 
ments simplify board layout when integrating multiple devices in a flash memory array or subsystem. This 
device uses an integrated Command User Interface and state machine for simplified block erasure and byte 
write. The 28FOO8SA-L memory map consists of 16 separately erasable 64-Kbyte blocks. 


Intel’s 28FOO8SA-L employs advanced CMOS circuitry for systems requiring low power consumption and 
noise immunity. Its 200 ns access time provides superior performance when compared with magnetic storage 
media. A deep powerdown mode lowers power consumption to 0.66 pW typical thru Voc, crucial in portable 
computing, handheld instrumentation and other low-power applications. The RP# power control input also 
provides absolute data protection during system powerup/down. 


Manufactured on Intel’s 0.8 micron ETOX process, the 28FOO8SA-L provides the highest levels of quality, 


reliability and cost-effectiveness. 


*Microsoft is a trademark of Microsoft Corporation. 


October 1993 
Order Number: 290435-003 
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PRODUCT OVERVIEW | 


The 28FO008SA-L is a high-performance 8-Mbit 
(8,388,608-bit) memory organized as 1 Mbyte 
(1,048,576 bytes) of 8 bits each. Sixteen 64-Kbyte 
(65,536-byte) blocks are included on_ the 
28F008SA-L. A memory map is shown in Figure 6 of 
this specification. A block erase operation erases 
one of the sixteen blocks of memory in typically 2.0 
seconds, independent of the remaining blocks. 
Each block can be independently erased and written 
_ 10,000 cycles. Erase Suspend mode allows sys- 
tem software to suspend block erase to read data or 
execute code from any other block of the 
28FO08SA-L. 


The 28F008SA-L is available in the 40-lead TSOP 
(Thin Small Outline Package, 1.2 mm thick) and 44- 
lead PSOP (Plastic Small Outline) packages. Pin- 
outs are shown in Figures 2 and 4 of this specifica- 
tion. 


The Command User Interface serves as the inter- 
face between the microprocessor or microcontroller 
and the internal operation of the 28FOO8SA-L. 


Byte Write and Block Erase Automation allow 
byte write and block erase operations to be execut- 
ed using a two-write command sequence to the 
Command User Interface. The internal Write State 
Machine (WSM) automatically executes the algo- 
rithms and timings necessary for byte write and 
block erase operations, including verifications, 


thereby unburdening the microprocessor or micro- — 


controller. Writing of memory data is performed in 
byte increments typically within 11 pus, Ipp byte 
write and block erase currents are 10 mA typical, 
30 mA maximum. Vpp byte write and block erase 
voltage is 11.4V to 12.6V. 
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The Status Register indicates the status of the 


WSM and when the WSM successfully completes 
the desired byte write or block erase operation. 


The RY/BY # output gives an additional indicator of 
WSM activity, providing capability for both hardware 
signal of status (versus software polling) and status 
masking (interrupt masking for background erase, 
for example). Status polling using RY/BY# mini- 
mizes both CPU overhead and system power con- 
sumption. When low, RY/BY# indicates that the 
WSN is performing a block erase or byte write oper- 
ation. RY/BY # high indicates that the WSM is ready 
for new commands, block erase is suspended or the 
device is in deep powerdown mode. 


Maximum access time is 200 ns (tacc) over the 
commercial temperature range (0°C to + 70°C) and 
over Vcc supply voltage range (3.0V to 3.6V and 
4.5V to 5.5V). Ie¢¢ active current (CMOS Read) is 
5 mA typical, 12 mA maximum at 5 MHz, 
3.3V +0.3V. 


When the CE# and RP# pins are at Vcc, the I¢¢ 
CMOS Standby mode is enabled. 


A Deep Powerdown mode is enabled when the 
RP# pin is at GND, minimizing power consumption 
and providing write protection. Ic¢ current in deep 
powerdown is 0.20 A typical. Reset time of 500 ns 
is required from RP# switching high until outputs are 
valid to read attempts. Equivalently, the device has a 
wake time of 1 ws from RP# high until writes to the 
Command User Interface are recognized by the 
28F008SA-L. With RP# at GND, the WSM is reset 
and the Status Register is cleared. 
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2 
@ 
i 


NOILWNEONI JONVAGY 


OUTPUT INPUT 

BUFFER BUFFER 
a IDENTIFIER 

REGISTER ac 

a 

72) 

re 

a STATUS a 

; E REGISTER 


OUTPUT 
MULTIPLEXER 


Te) 
- es oe: 
on COMMAND WE# 
: arena REGISTER OF# 
w 
ro} DATA RP# 
° 
2 COMPARATOR 
O —N 
& 
— RY /BY# 
= hy * Kis INPUT Y-DECODER Y-GATING WRITE STATE 
MACHINE PROGRAM/ERASE y 
VOLTAGE SWITCH PP 


BUFFER 
ADDRESS 
LATCH 


ADDRESS 
COUNTER 


X-DECODER 


+ Voc 
64 KBYTE 
BLOCKS — GND 
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Table 1. Pin Description 


| Symbol_| Type Name and Function : 


Ao-Aig INPUT ADDRESS INPUTS for memory addresses. Addresses are internally 
latched during a write cycle. 


| DQ9-DQ7 | INPUT/OUTPUT. | DATA INPUT/OUTPUTS: Inputs data and commands during Command 
User Interface write cycles; outputs data during memory array, Status 
Register and Identifier read cycles. The data pins are active high and 
float to tri-state off when the chip is deselected or the outputs are 
disabled. Data is internally latched during a write cycle. 

CE# INPUT CHIP ENABLE: Activates the device’s control logic, input buffers, 
decoders, and sense amplifiers. CE # is active low; CE # high deselects 
the memory device and reduces power consumption to standby levels. 

‘RP# INPUT RESET/ DEEP POWERDOWN: Puts the device in deep powerdown 
mode. RP # is active low; RP # high gates normal operation. RP# also 
locks out block erase or byte write operations when active low, providing 
data protection during power transitions. RP # active resets internal 
automation. Exit from Deep Powerdown sets device to read-array mode. 

OE # INPUT OUTPUT ENABLE: Gates the device’s outputs through the data buffers 
during a read cycle. OE # is active low. 

WE # INPUT WRITE ENABLE: Controls writes to the Command User Interface and 
array blocks. WE # is active low. Addresses and data are latched on the 
rising edge of the WE # pulse. 


RY/BY # OUTPUT READY/BUSY #: Indicates the status of the internal Write State 
Machine. When low, it indicates that the WSM is performing a block 
erase or byte write operation. RY/BY # high indicates that the WSM is 
ready for new commands, block erase is suspended or the device is in 

Vpp 

NOTE: 
With Vpp < Vpp_max, Memory contents cannot be altered. 
‘Vcc |~—~*~*~—__ | DEVICE POWER SUPPLY (3.3V +0.3V, 5V + 10%) 


deep powerdown mode. RY/BY # is always active and does NOT float 
to tri-state off when the chip is deselected or data outputs are disabled. 


BLOCK ERASE/BYTE WRITE POWER SUPPLY for erasing blocks of 
the array or writing bytes of each block. 
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Standard Pinout 


STANDARD PINOUT 
E28FOOQ8SA-L 
40 LEAD TSOP 
10mm x 20mm 

TOP VIEW 


Reverse Pinout 


q 


REVERSE PINOUT 
F28FOQO8SA-L 
40 LEAD TSOP 
10mm x 20mm 
TOP VIEW 
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Figure 2. TSOP Lead Configurations 
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Figure 5. 28FOO8SA-L Array Interface to Intel3.3V 80L186EB Embedded Microprocessor 
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PRINCIPLES OF OPERATION 


The 28FOO8SA-L includes on-chip write automation 

‘to manage write and erase functions. The Write 
State Machine allows for: 100% TTL-level control 
inputs; fixed power supplies during block erasure 
and byte write; and minimal processor overhead with 
RAM-like interface timings. 


After initial device powerup, or after return from 
deep powerdown mode (see Bus Operations), the 
28F008SA-L functions as a read-only memory. Ma- 
nipulation of external memory-control pins allow ar- 
ray read, standby and output disable operations. 
Both Status Register and intelligent identifiers can 
also be accessed through the Command User Inter- 
face when Vpp = Vpp,. 


This same subset of operations is also available 
when high voltage is applied to the Vpp pin. In addi- 
tion, high voltage on Vpp enables successful block 
erasure and byte writing of the device. All functions 
associated with altering memory contents—byte 
write, block erase, status and intelligent identifier— 
are accessed via the Command User Interface and 
verified thru the Status Register. 


Commands are written using standard microproces- 
sor write timings. Command User Interface contents 
serve as input to the WSM, which controls the block 
erase and byte write circuitry. Write cycles also inter- 
nally latch addresses and data needed for byte write 
or block erase operations. With the appropriate com- 
mand written to the register, standard microproces- 
sor read timings output array data, access the Intelli- 
gent Identifier codes, or output byte write and block 
erase status for verification. 


Interface software to initiate and poll progress of in- 
ternal byte write and block erase can be stored in 
any of the 28FOO8SA-L blocks. This code is copied 
to, and executed from, system RAM during actual 
flash memory update. After successful completion of 
byte write and/or block erase, code/data reads from 
the 28FOO8SA-L are again possible via the Read Ar- 
ray command. Erase suspend/resume capability al- 
lows system software to suspend block erase to 
read data and execute code from any other block. 


3-84 


Figure 6. Memory Map 


Command User interface and Write 
Automation 


An on-chip state machine controls block erase and 
byte write, freeing the system processor for other 
tasks. After receiving the Erase Setup and Erase 
Confirm commands, the state machine controls 
block pre-conditioning and erase, returning progress 
via the Status Register and RY/BY# output. Byte 
write is similarly controlled, after destination address 
and expected data are supplied. The program and 
erase algorithms of past Intel flash memories are 
now regulated by the state machine, including pulse 
repetition where required and internal verification 
and margining of data. 
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Data Protection 


Depending on the application, the system designer 
may choose to make the Vpp power supply switcha- 
ble (available only when memory byte writes/block 
erases are required) or hardwired to Vppy. When 
Vpp = Vpp._, memory contents cannot be altered. 
The 28FO08SA-L Command User Interface architec- 
ture provides protection from unwanted byte write or 
block erase operations even when high voltage is 
applied to Vpp. Additionally, all functions are dis- 
abled whenever Vcc is below the write lockout volt- 
age Vixo, or when RP # is at Vj,. The 28FOO8SA-L 
accommodates either design practice and encour- 
ages optimization of the processor-memory inter- 
face. 


The two-step byte write/block erase Command User 
Interface write sequence provides additional soft- 
ware write protection. 


BUS OPERATION 


Flash memory reads, erases and writes in-system 
via the local CPU. All bus cycles to or from the flash 
memory conform to standard microprocessor bus 
cycles. 


Read 


The 28F0O08SA-L has three read modes. The memo- 
ry can be read from any of its blocks, and informa- 
tion can be read from the Intelligent Identifier or 
Status Register. Vpp can be at either Vpp, or Vppy. 


28F008SA-L 


The first task is to write the appropriate read mode 
command to the Command User Interface (array, |n- 
telligent Identifier, or Status Register). The 
28F008SA-L automatically resets to Read Array 
mode upon initial device powerup or after exit from 
deep powerdown. The 28FO08SA-L has four control 
pins, two of which must be logically active to obtain 
data at the outputs. Chip Enable (CE #) is the device 
selection control, and when active enables the se- 
lected memory device. Output Enable (OE #) is the 
data input/output (DQ 9-—DQ7) direction control, and 
when active drives data from the selected memory 
onto the I/O bus. RP# and WE# must also be at 
Vin- Figure 10 illustrates read bus cycle waveforms. 


Output Disable 


With OE # at a logic-high level (Vj4), the device out- 
puts are disabled. Output pins (DQ 9-DQ7) are 
placed in a high-impedance state. 


Standby 


CE# at a logic-high level (Vj) places the 
28F008SA-L in standby mode. Standby operation 
disables much of the 28FOO8SA-L’s circuitry and 
substantially reduces device power consumption. 
The outputs (DQ9-DQ7) are placed in a high-impe- 
dence state independent of the status of OE #. If the 
28F008SA-L is deselected during block erase or 
byte write, the device will continue functioning and 
consuming normal active power until the operation 
completes. 


Table 2. Bus Operations 


Write 


NOTES: 


1. Refer to DC Characteristics. When Vpp = Vpp,, memory contents can be read but not written or erased. 
2. X can be Vj, or Viy for control pins and addresses, and Vpp, or Vppy for Vpp. See DC Characteristics for Vpp_ and Vppy 


voltages. 


3. RY/BY # is Vo, when the Write State Machine is executing internal block erase or byte write algorithms. It is Voy when 
the WSM is not busy, in Erase Suspend mode or deep powerdown mode. 
4. Command writes involving block erase or byte write are only successfully executed when Vpp = Vppy. 


5. Refer to Table 3 for valid Diy during a write operation. 
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Deep Power-Down 


The 28FOO8SA-L offers a deep power-down feature, 
entered when RP # is at Vj. Current draw thru Voc 
is 0.20 pA typical in deep powerdown mode, with 
current draw through Vpp typically 0.1 A. During 
read modes, RP#-low deselects the memory, 
places output drivers in a high-impedence state and 
turns off all internal circuits. The 28FOO8SA-L re- 
quires time tpyqy (see AC Characteristics-Read- 
Only Operations) after return from powerdown until 
initial memory access outputs are valid. After this 
wakeup interval, normal operation is restored. The 
Command User Interface is reset to Read Array, and 
the upper 5 bits of the Status Register are cleared to 
value 10000, upon return to normal operation. 


During block erase or byte write modes, RP# low 
will abort either operation. Memory contents of the 
block being altered are no longer valid as the data 
will be partially written or erased. Time tpyw_ after 
RP# goes to logic-high (Vj}) is required before an- 
other command can be written. 


This use of RP# during system reset is important 
with automated write/erase devices. When the sys- 
tem come out of reset, it expects to read from the 
flash memory. Automated flash memories provide 


. | 

intel. 
status information when accessed during write/ 
erase modes. If a CPU reset occurs with no flash 
memory reset, proper CPU initialization would not 
occur because the flash memory would be providing 
the status information instead of array data. Intel’s 
Flash Memories allow proper CPU initialization fol- 
lowing a system reset through the use of the RP# 
input. In this application RP# is controlled by the 
same RESET # signal that resets the system CPU. 


intelligent identifier Operation 


The Intelligent Identifier operation outputs the manu- 
facturer code, 89H; and the device code, A1H for 
the 28FOO8SA-L. The system CPU can then auto- 
matically match the device with its proper block 
erase and byte write algorithms. 


The manufacturer- and device-codes are read via 
the Command User Interface. Following a write of 
90H to the Command User Interface, a read from 
address location OOOOOH outputs the manufacturer 
code (89H). A read from address 00001H outputs 
the device code (A1H). It is not necessary to have 
high voltage applied to Vpp to read the Intelligent 
Identifiers from the Command User Interface. 


Table 3. Command Definitions 


Bus 
Cycles 


Read aray/nect «dt 
ntegert dente «| 
Read Stats Reviser (2 
erik 
aur 
wt 


NOTES: 
1. Bus operations are defined in Table 2. 


First Bus Cycle 


peration Data 


Write FEY 
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Second Bus Cycle 


Operation 


> 


= 


= O 
BBE 


= 


= w 


2. IA = Identifier Address: OOH for manufacturer code, 01H for device code. 


BA = Address within the block being erased. 
WA = Address of memory location to be written. 


3. SRD = Data read from Status Register. See Table 4 for a description of the Status Register bits. 
WD = Data to be written at location WA. Data is latched on the rising edge of WE#. 


lIiD = Data read from Intelligent Identifiers. 


4. Following the Intelligent Identifier command, two read operations access manufacture and device codes. 
5. Either 40H or 10H are recognized by the WSM as the Byte Write Setup command. 
6. Commands other than those shown above are reserved by Intel for future device implementations and should not be 


used. 
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Write 


Writes to the Command User Interface enable read- 
ing of device data and Intelligent Identifiers. They 
also control inspection and clearing of the Status 
Register. Additionally, when Vpp = Vppy, the Com- 
mand User Interface controls block erasure and byte 
write. The contents of the interface register serve as 
input to the internal state machine. 


The Command User Interface itself does not occupy 
an addressable memory location. The interface reg- 
ister is a latch used to store the command and ad- 
dress and data information needed to execute the 
command. Erase Setup and Erase Confirm com- 
mands require both appropriate command data and 
an address within the block to be erased. The Byte 
Write Setup command requires both appropriate 
command data and the address of the location to be 
written, while the Byte Write command consists of 
the data to be written and the address of the loca- 
tion to be written. 


The Command User Interface is written by bringing 
WE# to a logic-low level (Vi) while CE# is low. 
Addresses and data are latched on the rising edge 
of WE#. Standard microprocessor write timings are 
used. 


Refer to AC Write Characteristics and the AC Wave- 
forms for Write Operations, Figure 11, for specific 
timing parameters. 


28F008SA-L 


COMMAND DEFINITIONS 


When Vpp, is applied to the Vpp pin, read opera- 
tions from the Status Register, Intelligent Identifiers, 
or array blocks are enabled. Placing Vppy on Vpp 
enables successful byte write and block erase oper- 
ations as well. 


Device operations are selected by writing specific 
commands into the Command User Interface. Table 
3 defines the 28FOO8SA-L commands. 


Read Array Command 


Upon initial device powerup and after exit from deep 
powerdown mode, the 28FO08SA-L defaults to 
Read Array mode. This operation is also initiated by 
writing FFH into the Command User Interface. Mi- 
croprocessor read cycles retrieve array data. The 
device remains enabled for reads until the Com- 
mand User Interface contents are altered. Once the 
internal Write State Machine has started a block 
erase or byte write operation, the device will not rec- 
ognize the Read Array command, until the WSM has 
completed its operation. The Read Array command 
is functional when Vpp = Vpp_ or Vppp. 


intelligent identifier Command 


The 28FO08SA-L contains an Intelligent Identifier 
operation, initiated by writing 90H into the Command 


Table 4. Status Register Definitions 


WRITE STATE MACHINE STATUS 
Re 
B 


SR. 


SR. 


Error in Block Erasure 
Successful Block Erase 


BYTE WRITE STATUS 
Error in Byte Write 


SR.3 = Vpp STATUS 
= Vpp Low Detect; Operation Abort 
O = Vpp OK 
SR.2-SR.0 = RESERVED FOR FUTURE 
ENHANCEMENTS 

These bits are reserved for future use and 
should be masked out when polling the Status 
Register. 


7 
1 
0 
6 
1 
0 
.5 = ERASE STATUS 
1 
0 
4 
1 
0 
3 
1 


ADVANCE INFORMATION 


RY/BY # or the Write State Machine Status bit must first 
be checked to determine byte write or block erase com- 
pletion, before the Byte Write or Erase Status bit are 
checked for success. 


lf the Byte Write AND Erase Status bits are set to “1”’s 
during a block erase attempt, an improper command se- 
quence was entered. Attempt the operation again. 


lf Vpp low status is detected, the Status Register must be 
cleared before another byte write or block erase opera- 
tion is attempted. 


The Vpp Status bit, unlike an A/D converter, does not 
provide continuous indication of Vpp level. The WSM in- 
terrogates the Vpp level only after the byte write or block 
erase command sequences have been entered and in- 
forms the system if Vpp has not been switched on. The 
Vpp Status bit is not guaranteed to report accurate feed- 
back between Vpp, and Vppy. 
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User Interface. Following the command write, a read 
cycle from address OOOOOH retrieves the manufac- 
turer code of 89H. A read cycle from address 
00001H returns the device code of A1H. To termi- 
nate the operation, it is necessary to write another 
valid command into the register. Like the Read Array 
command, the Intelligent Identifier command is func- 
tional when Vpp = Vpp, or Vppy. 


Read Status Register Command 


The 28F008SA-L contains a Status Register which 
may be read to determine when a byte write or block 
erase operation is complete, and whether that oper- 
ation completed successfully. The Status Register 
may be read at any time by writing the Read Status 
Register command (70H) to the Command User In- 
terface. After writing this command, all subsequent 
read operations output data from the Status Regis- 
ter, until another valid command is written to the 
Command User Interface. The contents of the 
Status Register are latched on the falling edge of 
OE# 6r CE#, whichever occurs last in the read cy- 
cle. OE# or CE# must be toggled to Vj before 
further reads to update the Status Register latch. 
The Read Status Register command functions when 


Vpp = VppL Or VppH. 


Clear Status Register Command 


The Erase Status and Byte Write Status bits are set 
to “1”’s by the Write State Machine and can only be 
reset by the Clear Status Register Command. These 
bits indicate various failure conditions (see Table 4). 
By allowing system software to control the resetting 
of these bits, several operations may be performed 
(such as cumulatively writing several bytes or eras- 
ing multiple blocks in sequence). The Status Regis- 
ter may then be polled to determine if an error oc- 
curred during that sequence. This adds flexibility to 
the way the device may be used. 


Additionally, the Vpp Status bit (SR.3) MUST be re- 
set by system software before further byte writes or 
block erases are attempted. To clear the Status 
Register, the Clear Status Register command (50H) 
is written to the Command User Interface. The Clear 
Status Register command is functional when Vpp = 


VppL Or VppH. 


Erase Setup/Erase Confirm 
Commands 


Erase is executed one block at a time, initiated by a 


two-cycle command sequence. An Erase Setup 
command (20H) is first written to the Command User 


3-88 


intel. 


Interface, followed by the Erase Confirm command 
(DOH). These commands require both appropriate 
sequencing and an address within the block to be 
erased to FFH. Block preconditioning, erase and 
verify are all handled internally by the Write State 
Machine, invisible to the system. After the two-com- 
mand erase sequence is written to it, the 28BFOO8SA-L 
automatically outputs Status Register data when 
read (see Figure 8; Block Erase Flowchart). The 
CPU can detect the completion of the erase event 
by analyzing the output of the RY/BY# pin, or the 
WSM Status bit of the Status Register. 


When erase is completed, the Erase Status bit 
should be checked. If erase error is detected, the 
Status Register should be cleared. The Command 
User Interface remains in Read Status Register 
mode until further commands are issued to it. 


This two-step sequence of set-up followed by execu- 
tion ensures that memory contents are not acciden- 
tally erased. Also, reliable block erasure can only 
occur when Vpp = Vppy. In the absence of this high 
voltage, memory contents are protected against era- 
sure. If block erase is attempted while Vpp = Vpp,, 
the Vpp Status bit will be set to “1”. Erase attempts 
while Vppy < Vpp < Vppy produce spurious results 
and should not be attempted. 


Erase Suspend/Erase Resume 
Commands 


The Erase Suspend command allows block erase 
interruption in order to read data from another block 
of memory. Once the erase process starts, writing 
the Erase Suspend command (BOH) to the Com- 
mand User Interface requests that the WSM sus- 
pend the erase sequence at a predetermined point 
in the erase algorithm. The 28FOO8SA-L continues 
to output Status Register data when read, after the 
Erase Suspend command is written to it. Polling the 
WSM Status and Erase Suspend Status bits will de- 
termine when the erase operation has been sus- 
pended (both will be set to 1’). RY/BY# will also 
transition to Vou. 


At this point, a Read Array command can be written 
to the Command User Interface to read data from 
blocks other than that which is suspended. The only 
other valid commands at this time are Read Status 
Register (70H) and Erase Resume (DOH), at which 
time the WSM will continue with the erase process. 
The Erase Suspend Status and WSM Status bits of 
the Status Register will be automatically cleared and 
RY/BY # will return to Vo,. After the Erase Resume 
command is written to it, the 28FOO8SA-L automati- 
cally outputs Status Register data when read (see 
Figure 9; Erase Suspend/Resume Flowchart). Vpp 
must remain at Vppy while the 28FOO8SA-L is in 
Erase Suspend. 
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Byte Write Setup/Write Commands 
(40H or 10H) 7 


Byte write is executed by a two-command sequence. 
The Byte Write Setup command (40H or 10H) is writ- 
ten to the Command User Interface, followed by a 
second write specifying the address and data 
(latched on the rising edge of WE#) to be written. 
The WSM then takes over, controlling the byte write 
and write verify algorithms internally. After the two- 
command byte write sequence is written to it, the 
28F008SA-L automatically outputs Status Register 
data when read (see Figure 7; Byte Write Flowchart). 
The CPU can detect the completion of the byte write 
event by analyzing the output of the RY/BY # pin, or 
the WSM Status bit of the Status Register. Only the 
Read Status Register command is valid while byte 
write is active. 


When byte write is complete, the Byte Write Status 
bit should be checked. If byte write error is detected, 
the Status Register should be cleared. The internal 
WSM verify only detects errors for “1’’s that do not 
successfully write to ‘0’’s. The Command User In- 
terface remains in Read Status Register mode until 
further commands are issued to it. If byte write is 
attempted while Vpp = Vpp,,.the Vpp Status bit will 


be set to “1”. Byte write attempts while Vpp_ < Vpp - 


< VppyH produce spurious results and should not be 
attempted. 


EXTENDED BLOCK ERASE/BYTE 
WRITE CYCLING 


Intel has designed extended cycling capability into 
its ETOX flash memory technologies. The 
28F008SA-L is designed for 10,000 byte write/block 
erase cycles on each of the sixteen 64-Kbyte 
blocks. Low electric fields, advanced oxides and 
minimal oxide area per cell subjected to the tunnel- 
ing electric field combine to greatly reduce oxide 
stress and the probability of failure. A 20-Mbyte sol- 
id-state drive using an array of 28FOO8SA-Ls has a 
MTBF (Mean Time Between Failure) of 3.33 million 
hours(1), over 60 times more reliable than equivalent 
rotating disk technology. 


AUTOMATED BYTE WRITE 


The 28FO008SA-L integrates the Quick-Pulse pro- 
gramming algorithm of prior Intel Flash Memory de- 
vices on-chip, using the Command User Interface, 
Status Register and Write State Machine (WSM). 
On-chip integration dramatically simplifies system 
software and provides processor interface timings to 
the Command User Interface and Status Register. 
WSM operation, internal verify and Vpp high voltage 
presence are monitored and reported via the 
RY/BY# output and appropriate Status Register 
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bits. Figure 7 shows a system software flowchart for 
device byte write. The entire sequence is performed 
with Vpp at Vppy. Byte write abort occurs when RP # 
transitions to Vj,, or Vpp drops to Vpp,. Although the 
WSM is halted, byte data is partially written at the 
location where byte write was aborted. Block era- 
sure, or a repeat of byte write, is required to initialize 
this data to a known value. 


AUTOMATED BLOCK ERASE 


As above, the Quick-Erase algorithm of prior Intel 
Flash devices is now implemented internally, includ- 
ing all preconditioning of block data. WSM opera- 
tion, erase success and Vpp high voltage presence 
are monitored and reported through RY/BY# and 
the Status Register. Additionally, ifa command other 
than Erase Confirm is written to the device following 
Erase Setup, both the Erase Status and Byte Write 
Status bits will be set to ‘1’’s. When issuing the 
Erase Setup and Erase Confirm commands, they 
should be written to an address within the address 
range of the block to be erased. Figure 8 shows a 
system software flowchart for block erase. 


Erase typically takes 2.0 seconds per block. The 
Erase Suspend/Erase Resume command sequence 
allows suspension of this erase operation to read 
data from a block other than that in which erase is 
being performed. A system software flowchart is 
shown in Figure 9. 


The entire sequence is performed with Vpp at Vppy. 
Abort occurs when RP# transitions to Vj, or Vpp 
falls to Vpp,, while erase is in progress. Block data is 
partially erased by this operation, and a repeat of 
erase is required to obtain a fully erased block. 


DESIGN CONSIDERATIONS 


Three-Line Output Control 


The 28FO08SA-L will often be used in large memory 
arrays. Intel provides three control inputs to accom- 
modate multiple memory connections. Three-line 
control provides for: 


a) lowest possible memory power dissipation 


b) complete assurance that data bus contention will 
not occur 


To efficiently use these control inputs, an address 
decoder should enable CE#, while OE# should be 
connected to all memory devices and the system’s 
READ # control line. This assures that only selected 
memory devices have active outputs while deselect- 
ed memory devices are in Standby Mode. RP# 
should be connected to the system Powergood sig- 
nal to prevent unintended writes during system pow- 
er transitions. Powergood should also toggle during 
system reset. 


(1)Assumptions: 10-Kbyte file written every 10 minutes. (20-Mbyte array)/(10-Kbyte file) = 2,000 file writes before erase required. 
(2000 files writes/erase) < (10,000 cycles per 28FOO8SA-L block) = 20 million file writes. 
(20 x 1086 file writes) < (10 min/write) < (1 hr/60 min) = 3.33 <x 106 MTBF. 
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RY/BY # and Byte Write/Block Erase 
Polling 


RY/BY # is a full CMOS output that provides a hard- 
-ware method of detecting byte write and block erase 
completion. It transitions low time twHr. after a 
write or erase command sequence is written to the 


a 
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28F008SA-L, and returns to Voy when the WSM 
has finished executing the internal algorithm. 


RY/BY # can be connected to the interrupt input of 
the system CPU or controller. It is active at all times, 
not tristated if the 28FOO8SA-L CE # or OE# inputs 
are brought to Viy. RY/BY# is also Voy when the 


device is in Erase Suspend or deep powerdown 


modes. 


Write 40H (10H), Byte Write | Data = 40H (10H) 


Operation 
Byte Address Setup Address = Byte to be written 


Write Byte 
Address/Data 


r 


Data to be written 
Address = Byte to be written 


Byte Write 


Standby/Read Check RY/BY # 

Von = Ready, Vo. = Busy 
or 

Read Status Register 

Check SR.7 

1 = Ready, 0 = Busy 

Toggle OE # or CE# to 

update Status Register 


Full Status 
Check if Desired 


Byte Write Repeat for subsequent bytes 
Completed 

290435-13 Full status check can be done after each byte or after a 
sequence of bytes 
Write FFH after the last byte write operation to reset the 


device to Ready Array Mode 


mus Command - Comments 
Operation 


Optional CPU may already have read 
Read Status Register data in WSM 
Ready polling above 


FULL STATUS CHECK PROCEDURE 


Status Register Data 
Read (See Above) 


Standby Check SR.3 


1 = Vpp Low Detect 


Vpp Range 
Error 
Byte Write 
Error 


Standby Check SR.4 


1 = Byte Write Error 


SR.3 MUST be cleared, if set during a byte write attempt, 
before further attempts are allowed by the Write State 
Machine. 


YE 


Ss 
Byte Write 
Successful 


SR.4 is only cleared by the Clear Status Register Command, 
in cases where multiple bytes are written before full status is 


290435-14 checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 7. Automated Byte Write Flowchart 
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Operation 


Write 20H, Data = 20H 
Block Address Address = Within block to be 
erased 


Write DOH, Data = DOH 
Block Address Address = Within block to be 
' erased 


Erase Suspend 


WSM i. ae Standby/Read Check RY/BY # 
Ready? Erase? VonH = Ready, Vo_ = Busy 
or 


YE Read Status Register 
Check SR.7 
Full Status - | 1 = Ready, 0 = Busy 
Check if Desired Toggle OE # or CE# to 


update Status Register 
Block Erase Repeat for subsequent bytes 
Completed 


290435-15 Full status check can be done after each block or after a 
sequence of blocks 


Write FFH after the last block erase operation to reset the 
device to Ready Array Mode | 


ee ee oe jcommand | Comments 
Command Comments 
Operation : 


Status Register Data Optional 


Read (See Above) CPU may already have read 


Read Status Register data in WSM 
Ready polling above 


Standby Check SR.3 
Error 1 = Vpp Low Detect 
Both 1 = Command Sequence 


Error 


Block Erase 
Standby Check SR.5 


1 = Block Erase Error 


YES 
SR.3 MUST be cleared, if set during a block erase attempt, 


before further attempts are allowed by the Write State 


Block Erase , 
Machine 


Successful 


290435-16 SR.5 is only cleared by the Clear Status Register 
Command, in cases where multiple blocks are erased 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 8. Automated Block Erase Flowchart 
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Write BOH 


Write 70H 


Read Status 
Register 


val 


<3 0 


Erase Has 
YES Completed 


Write FFH 


Done 
Reading? 


1 


YES 


Write DOH 


Continue Erase 


290435-17 


Standby/ 


Standby 


Bus 


Erase Data = BOH 


Suspend 


Read Data = 70H 
Status Register 


Check RY/BY # 


Read Von = Ready, 
VoL = Busy 
or 


Read Status Register 
Check SR.7 

1 = Ready, 0 = Busy 
Toggle OE # or CE# to 
Update Status Register 


Check SR.6 
1 = Suspended 


Read Array Data = FFH 


Read array data from block 
other than that bein 
erased. 


Erase Resume Data = DOH 


Figure 9. Erase Suspend/Resume Flowchart 


Power Supply Decoupling 


Flash memory power switching characteristics re- 
quire careful device decoupling. System designers 
are interested in 3 supply current issues; standby 
current levels (Isp), active current levels (Icc) and 
transient peaks produced by falling and rising edges 
of CE#. Transient current magnitudes depend on 
the device outputs’ capacitive and inductive loading. 
Two-line control and proper decoupling capacitor 
selection will suppress transient voltage peaks. 
Each device should have a 0.1 F ceramic capacitor 
connected between each Vcc and GND, and be- 
tween its Vpp and GND. These high frequency, low 
inherent-inductance capacitors should be placed as 
close as possible to package leads. Additionally, for 
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every 8 devices, a 4.7 uF electrolytic capacitor 
should be placed at the array’s power supply con- 
nection between Vcc and GND. The bulk capacitor 
will overcome voltage slumps caused by PC board 
trace inductances. 


Vpp Trace on Printed Circuit Boards 


Writing flash memories, while they reside in the tar- 
get system, requires that the printed circuit board 
designer pay attention to the Vpp power supply 
trace. The Vpp pin supplies the memory cell current 
for writing and erasing. Use similar trace widths and 
layout considerations given to the Vcc power bus. 
Adequate Vpp supply traces and decoupling will de- 
crease Vpp voltage spikes and overshoots. 
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Vcc: Vpp, RP # Transitions and the 
Command/Status Registers 


Byte write and block erase completion are not guar- 
anteed if Vpp drops below Vppy. If the Vpp Status bit 
of the Status Register (SR.3) is set to “1”, a Clear 
Status Register command MUST be issued before 
further byte write/block erase attempts are allowed 
by the WSM. Otherwise, the Byte Write (SR.4) or 
Erase (SR.5) Status bits of the Status Register will 
be set to “1’’s if error is detected. RP # transitions to 
Vi. during byte write and block erase also abort the 
operations. Data is partially altered in either case, 
and the command sequence must be repeated after 
normal operation is restored. Device poweroff, or 
RP# transitions to Vj,, clear the Status Register to 
initial value 10000 for the upper 5 bits. 


The Command User Interface latches commands as 
issued by system software and is not altered by Vpp 
or CE# transitions or WSM actions. Its state upon 
powerup, after exit from deep powerdown or after 
Vcc transitions below V, xo, is Read Array Mode. 


After byte write or block erase is complete, even 
after Vpp transitions down to Vpp,, the Command 
User Interface must be reset to Read Array mode via 
the Read Array command if access to the memory 
array is desired. 


Power Up/Down Protection 


The 28FO08SA-L is designed to offer protection 
against accidental block erasure or byte writing dur- 
ing power transitions. Upon power-up, the 
28F008SA-L is indifferent as to which power supply, 
Vpp or Vcc, powers up first. Power supply sequenc- 
ing is not required. Internal circuitry in the 
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28F008SA-L ensures that the Command User Inter- 
face is reset to the Read Array mode on power up. 


A system designer must guard against spurious 
writes for Vcc voltages above ViKo when Vpp is 
active. Since both WE# and CE# must be low fora 
command write, driving either to Vj will inhibit 
writes. The Command User Interface architecture 
provides an added level of protection since altera- 
tion of memory contents only occurs after success- 
ful completion of the two-step command sequences. 


Finally, the device is disabled until RP # is brought to 


Vin, regardless of the state of its control inputs. This 
provides an additional level of memory protection. 


Power Dissipation 


When designing portable systems, designers must 
consider battery power consumption not only during 
device operation, but also for data retention during 
system idle time. Flash nonvolatility increases us- 
able battery life, because the 28FOO8SA-L does not 
consume any power to retain code or data when the 
system is off. 


In addition, the 28FOO8SA-L’s deep powerdown 
mode ensures extremely low power dissipation even 
when system power is applied. For example, porta- 
ble PCs and other power sensitive applications, us- 
ing an array of 28FOO8SA-Ls for solid-state storage, 
can lower RP# to Vj, in standby or sleep modes, 
producing negligable power consumption. If access 
to the 28FOO8SA-L is again needed, the part can 
again be read, following the tpyay and tpyw._ wake- 
up cycles required after RP# is first raised back to 
Vin. See AC Characteristics—Read-Only and Write 
Operations and Figures 10 and 11 for more informa- 
tion. 
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ABSOLUTE MAXIMUM RATINGS* NOTICE: This data sheet contains information on 


products in the sampling and initial production phases 
Operating Temperature of development. The specifications are subject to 
CNG ROAD, vk ve de'sa sd deh es ees 0°C to + 70°C(1) change without notice. Verify with your local Intel 
During Block Erase/Byte Write ....0°C to + 70°C Sales office that you have the latest data sheet be- 
Temperature Under Bias......... —10°C to +80°C fore finalizing a design. 
Storage Temperature .......... ~65°C to + 125°C sf WARNING: Stressing the device beyond the “Absolute 
; Maximum Ratings” may cause permanent damage. 
Voltage on Any Pin These are stress ratings only. Operation beyond the 
(except Vcc and Vpp) “Operating Conditions” is not recommended and ex- 
with Respect toGND ........ —2.0V to +7.0V(2) tended exposure beyond the “Operating Conditions” 
Vpp Program Voltage with may affect device reliability. 


Respect to GND during 
Block Erase/Byte Write ... —2.0V to + 14.0V(2, 3) 


Vcc Supply Voltage 


with Respect toGND........ —2.0V to +7.0V(2) 
Output Short Circuit Current............. 100 mA(4) 
NOTES: 


1. Operating temperature is for commercial product defined by this specification. 

2. Minimum DC voltage is —0.5V on input/output pins. During transitions, this level may undershoot to —2.0V for periods 
<20 ns. Maximum DC voltage on input/output pins is Vcc + 0.5V which, during transitions, may overshoot to Voc + 2.0V 
for periods <20 ns. 

3. Maximum DC voltage on Vpp may overshoot to + 14.0V for periods <20 ns. 

4. Output shorted for no more than one second. No more than one output shorted at a time. 

5. AC specifications are valid at both voltage ranges. See DC Characteristics for voltage range specific specification. 


OPERATING CONDITIONS 


Parameter 


Operating Temperature 
Vcc Supply Voltage 
Voc Supply Voltage 


Parameter 


Input Load Current 
Output Leakage Current 


CE# = RP# = Vcc +0.2V 


RP# = GND +0.2V 
lout (RY/BY #) = OmA 


= Voc Max, CE# = GND 
f = 5 MHz, lout = OmA 
CMOS Inputs 

= Vcc Max, CE# = Vi, 
f = 8 MHz, lout = OMA 
TTL Inputs 
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DC CHARACTERISTICS (Continued) 


[symbot| Parameter [Notes | win [Typ Max [Unit] Test Condition 
ecw | VooByewtecurent | 1 | | 6 | 18 | ma | 6ytowrtonProgess 
coe [Vos Block Erase Curent | 1 | | 6 | 18 | ma | Block ree Progress 


IcceEs Voc Erase Suspend Current | 1, 2 mA | Block Erase Suspended 
CE# = Vin 
wos Vpp Standby Current | GP ss — 
20 | 200 | A | Vpp>Voo 
Vpp Deep PowerDown 0.10 pA | RP# = GND +0.2V 
Current 
Vpp Byte Write Current 10 mA | Vpp = VppyH 
Byte Write in Progress 
Vpp Block Erase Current 1 mA | Vpp = VppH 
Block Erase in Progress 
Vpp Erase Suspend LA | Vpp = Vppy 
Current «ee Erase Suspended 


spate ete __ 
Vin | Input |InputHigh Voltage si Voltage fa | fees 


Output Low Voltage 0.4 Voc = Vec Min 
lo. = 2mA 
Output High Voltage Voc = Vcc Min 
lon = —2mA 
VpPL Vpp during Normal V 
Operations 
VpPH Vpp during Erase/Write 11.4 | 12.0 12.6 V 
Operations 
VLKO Voc Erase/Write Lock V 
Voltage 


CAPACITANCE(S) T, = 25°C, f = 1 MHz 


| Symbol | Parameter | Typ | Max | Unit | Condition | 
/Civ__| ImputCapacitance | 6 | 8 | pF | Vin=0V | 
Cour | OutputCapacitance | _@ | 12 | pF | Vour = ov | 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Vcc = 3.3V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (packages and speeds). 

2. Icces is specified with the device deselected. If the 28FOO8SA-L is read while in Erase Suspend Mode, current draw is 
the sum of Icces and Iccr. 

3. Includes RY/BY #. 

4. Block Erases/Byte Writes are inhibited when Vpp = Vpp, and not guaranteed in the range between Vppy and Vpp_. 

5. Sampled, not 100% tested. 
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DC CHARACTERISTICS Voc = 5.0V +10% 


Symbol! _Parameter__—_—[Notes| Min |Typ| Max [Unit] Test Condition 


ly Input Load Current 1 AG BA | Voc = Vcc Max 
Vin = Voc or GND 
ILo Output Leakage Current 1 +10 BA | Voc = Voc Max 
Vout = Vcc or GND 
locs Voc Standby Current 1.0 MA | Vcc = Voc Max 
CE# = RP# = Vip 
100 BA | Voc = Voc Max 
CE# = RP# = Vcc £0.2V 
IccD Voc Deep PowerDown 1.2 pA | RP# = GND +0.2V 
Current lout (RY/BY #) = OmA 


ICCR Voc Read Current mA | Vcc = Vcc Max, CE# = GND 
f = 5 MHz, lour = OMA 
CMOS Inputs 
mA | Vcc = Voc Max, CE# = Vi, 
= 5 MHz, lout = OmA 
TTL Inputs 


cow __|VocByteWrite Current | 1 | | 10| 30 | mA|ByteWriteIn Progress 
Icce__|VocBlock Erase Current | 1 | | 10| 30 | mA|BlockErasein Progress 


Vcc Erase Suspend Current 10 =| mA | Block Erase Suspended, 
CE# = Vin 


Vpp Standby Current 


es ee 
re ee eee 
Current 

Ph, 4 BO} 200.3 


I+ 
rr 
on 
B 
> 
< 
a) 
vu 
| 
< 
QO 
@) 


Vpp Read Current 1 | 90 


IPpw Vpp Byte Write Current ue 
Vpp Block Erase Current 
Vpp Erase Suspend 1 
Current 
Input Low Voltage 
Input High Voltage 


ae 
Lae 
err 


Vpp = VppH 
Byte Write in Progress 


mA | Vpp = VppH. 
Block Erase in Progress 


Vpp = VpPH 
Block Erase Suspended 


© 
QO 
m 
ie) 


VIL 

ViH 
VoL 
VOH Output High Voltage ee 
Vpp during Erase/Write 11.4 | 12.0 

Operations 


Voc Erase/Write Lock 
Voltage 


< < < 
= a) a) 
Az a) U 
O Fs = 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Voc = 5.0V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (packages and speeds). 

2. Icces is specified with the device deselected. If the 28FOO8SA-L is read while in Erase Suspend Mode, current draw is 
the sum of Icces and Iccr. 

3. Includes RY/BY #. 

4. Block Erases/Byte Writes are inhibited when Vpp = Vpp, and not guaranteed in the range between Vppy and Vpp,. 
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AC INPUT/OUTPUT REFERENCE WAVEFORM AC TESTING LOAD CIRCUIT(2) 


3.0 = = (= 
INPUT la So TEST POI i a OUTPUT 
0.0 


290435-7 


DEVICE 
UNDER 


AC test inputs are driven at 3.0V for a Logic “1” and 0.0V for a Logic “0”. Input timing TEST 


begins, and output timing ends, at 1.5V. Input rise and fall times (10% to 90%) < 10 ns. 


CL = 50 pF 

C. Includes Jig 
Capacitance 

Ry = 3.3 kN 


Versions 


| Symbol Parameter 
Pavav | tor | OE#toOutputDelay 
t 


RC 
CE 
CE # to Output Low Z 
CE # High to Output High Z : 
OE# to Output Low Z 
OE# High to Output High Z 

{OH 


Output Hold from Addresses, CE # or OE # 
Change, Whichever is First 


NOTES: 

1. See AC Input/Output Reference Waveform for timing measurements. 

2. OE# may be delayed up to tce-tog after the falling edge of CE # without impact on tce. 
3. Sampled, not 100% tested. 
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SUOI}EIOdO PES 10) WIOJSABM OV ‘O} eunbi4 


Veco POWER-UP STANDBY ARES aerETiON OUTPUTS ENABLED DATA VALID STANDBY Veg POWER-DOWN 
Vin _— 
04.004 * me" x 
ADDRESSES (A) é ADDRESSES STABLE 4 
is Lt a Oe NS sa ' IV VV VV YN 
tavaV 


HIGH Z 


teLav 
tcLax 


teLox 


vee 


tcLav 


tpHav 


VALID OUTPUT 


tou 


teHOz 


tcHoz 


EAN 
YT 


HIGH Z 
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AC CHARACTERISTICS—Write Operations( Voc = 3.3V +0.3V, 5.0V +10% 


Parameter | Notes | Min | Max _ 
tcs 
twp 


iddddd 


7 
tov | tos | Data SetuptoWE# GongHigh 
wen WE# HightoRV/BY# Gongiow 


twHave |” Duration of Block Erase Operation | 5,6 | O38... 
tWHGL Write Recovery ps 
before Read 


NOTES: 

1. Read timing characteristics during erase and byte write operations are the same as during read-only operations. Refer to 
AC Characteristics for Read-Only Operations. 

2. Sampled, not 100% tested. 

3. Refer to Table 3 for valid Ajj for byte write or block erasure. 

4. Refer to Table 3 for valid Diy for byte write or block erasure. 

5. The on-chip Write State Machine incorporates all byte write and block erase system functions and overhead of standard 
Intel flash memory, including byte program and verify (byte write) and block precondition, precondition verify, erase and 
erase verify (block erase). 

6. Byte write and block erase durations are measured to completion (SR.7 = 1, RY/BY# = Voy). Vpp should be held at 
VppyH until determination of byte write/block erase success (SR.3/4/5 = 0) 


aiid] 
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a 
FBockWmeTme mat fp 


NOTES: 
1. 25°C, 12.0 Vpp. s 
2. Excludes System-Level Overhead. 
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SUOI}EIOdO OM JO} WUOJOARM OV “LL eunbi4 


LOL-E 


WRITE 
Voc POWER-UP WRITE BYTE WRITE OR VALID ADDRESS & DATA(BYTE WRITE) AUTOMATED BYTE WRITE READ STATUS WRITE READ ARRAY 
& STANDBY ERASE SETUP COMMAND OR ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER DATA COMMAND 


V, 
IH XY XXX KK KKK KX) OOOO \/ XK KKK XX \/ » (XN XX XX VY rere 
wes 0 ROK DRS RRR 


Vit 


Vin 
CE# (E) 
Vit 


Vin 
OE# (G) 
Vit 


twHav1, 2 


Vin : 
WE# (W) 
‘t pwr 
‘ovwH 
V 
". . HIGKZ & [7 vaio \\ 
Yow Y \\ 


DATA (D/Q) 
Vib HWE 


SRD f/f 


= tWHRL 


ee ‘avvt 
TT 


x) XY XX) KXX KKXX XXXXX (Y \/ 
PPL kx I\/\/V/\ XKKX YY X Y X YY x WY x OR NNN 
Vi (XYKXYKKKKK KK KKK KX WAVAV, Vv, XX XX XX XKX \/ XxX VAVAVAVAY, 

KRY KKK 
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Vou 
RY /BY# (R) 


WAVAVAVAVAVAVAVAVAVAVAY, 
OY : 
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Versions 


Parameter 
twc_| Write Cycle Time 
/tpHer | tps | P# High Recovery to CE# Going Low 


tws E# Setup to CE# Going Low 


/tereH | tcp | CE# Pulse Width 
Vpp Setup to CE # Going High 


tcp 
ddress Setup to CE# Going High 
AH 


ata Setup to CE# Going High 


eta 
Re 
ue ey 
va 
Se ae 
te 18 
mim 
ata Hold from CE# High ee 
tats 
oe 
ane 
mee 
Pes 
eee 
aes 
Bee | 


Address Hold from CE# High 
E# Hold from CE # High 
tener | tepy | CE# Pulse Width High 
/teup, | | CE# High to RY/BY# Going Low 


Duration of Byte Write Operation 


ae 
teHave | | Duration of Block Erase Operation 
ter 


ci ae Write Recovery before Read 
tvPH 


NOTES: 

1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of CE# and WE#. In systems where 
CE# defines the write pulsewidth (within a longer WE # timing waveform), all setup, hold and inactive WE# times should be 
measured relative to the CE # waveform. 

2. Sampled, not 100% tested. 

3. Refer to Table 3 for valid Ajj for byte write or block erasure. 

4. Refer to Table 3 for valid Diy for byte write or block erasure. 

5. Byte write and block erase durations are measured to completion (SR.7 = 1, RY/BY# = Von). Vpp should be held at 
VppxH until determination of byte write/block erase success (SR.3/4/5 = 0) 


Vpp Hold from Valid SRD, RY/BY # High 
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EOL-€ 


Voc POWER-UP WRITE BYTE WRITE OR VALID ADDRESS & DATA(BYTE WRITE) AUTOMATED BYTE WRITE 
OR ERASE CONFIRM COMMAND 


te Gis He: 


Vin 
ADDRESSES (A) 


DATA (D/Q) 
Vit 


Vou 
RY /BY# (R) 


V/ 


¢ 
we 
KNX 


KX 
XY 
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ORDERING INFORMATION 


EPET PEE EE LEC: 
Kc | Pe ACCESS SPEED (ns) 


PACKAGE 3.3V 200 ns 


E = STANDARD 40 LEAD TSOP 
F REVERSE 40 LEAD TSOP 


PA = 44 LEAD PSOP 290435-12 


VALID COMBINATIONS: 
E28F008SA-L200  F28F008SA-L200 PA28F008SA-L200 


ADDITIONAL INFORMATION 


Order 

Number 
28F008SA Datasheet 290429 
-AP-359 ‘“28FO08SA Hardware Interfacing”’ 292094 
AP-360 “25F008SA Software Drivers” 292095 
AP-364 “28F008SA Automation and Algorithms” 292099 
ER-27 “The Intel 28FOO8SA Flash Memory” 294011 
ER-28 “ETOX Ill Flash Memory Technology” 290412 


REVISION HISTORY 


fel i ee ee 
Modified Erase Suspend Flowchart . | 
Lowered V; xo from 2.2V to 2.0V 
Combined Vpp Standby Current and Vpp Read Current into One Vpp Standby Current Spec. 
with Two Test Conditions (DC Characteristics Table) 


Removed —250 Speed Bin 
PWD renamed to RP# for JEDEC standardization compatibility. 


Changed Ipps standby current specifications from +10 pA to +15 pA in DC Characteristics 
tables. 
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intel. 
1.0 INTRODUCTION 


The 28F008SA FlashFileTM Memory is a very high 
performance 8 Mbit (8,388,608 bit) memory, organized 
as 1 Mbyte (1,048,576 bytes) of 8 bits each. The 
28FOO8SA contains sixteen 64 Kbyte (65,536 byte) 
blocks, each block separately eraseable and capable of 
100,000 byte write-block erase cycles. On-chip automa- 
tion dramatically simplifies software algorithms, and 
frees the system microprocessor to service higher prior- 
ity tasks during component data update. An enhanced 
system interface allows switching the 28FOO8SA into a 
deep powerdown mode during periods of inactivity, and 
gives a hardware indication of the status of the internal 
Write State Machine. High-speed access time allows 
minimal wait-state interfacing to microprocessor buses, 
and advanced packaging provides optimum density/ 
in2. 


Features of the 28FOO8SA include: 

© High-Density Symmetrically Blocked Architecture: 
— Sixteen 64 Kbyte Blocks 

@ Extended Cycling Capability 
— 100,000 Block Erase Cycles 
— 1.6 Million Block Erase Cycles per Chip 


Today's Memory Paradigm 


AP-359 


Automated Byte Write and Block Erase 
— Command User Interface 

— Status Register 

System Performance Enhancements 

— RY/BY*# Status Output 

— Erase Suspend Capability 

Deep Powerdown Mode 

— 0.20 pA Icc Typical 

Very High Performance Read 

— 85 ns Maximum Access Time 
SRAM-Compatible Write Interface 
Hardware Data Protection Features 

— Erase/Write Lockout during Power Transitions 
Industry Standard Packaging 

— 40 Lead TSOP, 44 Lead PSOP 


e ETOX III Nonvolatile Flash Memory 


Technology 
— 12V Byte Write/Block Erase 


The Future, Using Flash Memory 
292094-1 


Figure 1. The 28F008SA Revolutionizes the Architecture of Computing 
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Figure 2. 28F008SA Block Diagram 


Traditional system architectures combine slow, high 
density nonvolatile mass storage (such as a disk drive) 
and fast, volatile memory (such as DRAM) to fully 
address system requirements. As Figure 1 illustrates, 
flash memory combines the best features of both the 
above memory technologies, making a “disk/DRAM” 
approach to system architecture unnecessary and ulti- 
mately wasteful. Flash memory is rapidly approaching 
DRAM in both cost and performance (especially in 
cached systems), while adding capabilities (such as non- 
volatility), that DRAM cannot claim. The 28F008SA 
will be the building block memory of choice for emerg- 
ing computing markets, whether integrated in a memo- 
ry card or disk drive form factor, or resident on the 
system motherboard. 


This application note discusses hardware interfacing of 
the 28FOO8SA flash memory to system designs. The 
28FOO8SA datasheet (order number 290429) is a valu- 
able reference document, providing in-depth device 
technical specifications, package pinouts and timing 
waveforms. Additionally, companion application note 
AP-360, “28FOO8SA Software Drivers” (order number 
292095) provides example ASM-86 and “C” routines 
for controlling the 283FOO8SA. AP-364 “28FOO8SA Au- 
tomation and Algorithms” discusses in-depth operation 
of the 28FOO8SA Write State Machine and internal al- 
gorithms, emphasizing how they interface to system 
software and hardware. AP-360 and AP-364 should be 
reviewed in conjunction with this application note and 
the 28FOO8SA datasheet for a complete understanding 
of this device. 
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2.0 HARDWARE INTERFACING 


Figure 2 shows a block diagram of the 28FOO8SA and 
its internal contents. The CE# (chip enable) and OE# 
(output enable) inputs have comparable enable and 
read functions to those of other memory technologies 
such as SRAM. Similarly, Voc is the component power 
supply (SV +10%), while GND should be connected 
to system ground. Address inputs allow the system to 
select a specific byte for reading or writing/erasing, and 
the 8-bit data bus transfers information to and from the 
28FOO08SA. The other control lines (WE#, RP#, 
RY/BY # and Vpp) are discussed below. 


2.1 Vpp (Byte Write/Block Erase 
Voltage) 


The Vpp input supplies high voltage to the 28FOO8SA 
to enable byte write and block erase. Vpp is specified at 
12V +5% (11.4V-12.6V). Attempting to byte write or 
block erase the 28FOO8SA beyond the 5% 12V toler- 
ance is not recommended. Vpp above 12.6V can poten- 
tially result in device damage, and Vpp below 11.4V 
dramatically lengthens write/erase time and compro- 
mises data reliability. The 28FOO8SA is guaranteed to 
prevent byte write and block erase attempts with Vpp 
below 6.5V, and in this situation it reports a “low Vpp 
error” through the component Status Register (see 
AP-360, AP-364 or the 28FOO8SA datasheet). 


S 
intel. 
Vpp Generation Circuits 


12V is often already present in systems, used to power 
the hard drive, display, RS-232 circuitry, flash BIOS 
update, etc. If it meets the tolerance and current capa- 
bility requirements of the 28FOO8SA, such a power sup- 
ply could be used directly as the 28FOO8SA update 
voltage source. However, 12V is sometimes not present 
or otherwise required, and in such cases, the 28FOO8SA 
Vpp must be derived from existing voltages and sup- 
plies. 


Fortunately, flash memory’s rapidly increasing popu- 
larity has driven ever-improving 12V converter avail- 
ability in the market. These solutions derive a regulated 
12V from a wide range of input voltages, and offer var- 
ied levels of integration and current delivery capability. 
In general, the input for 12V converters should come 
from the unregulated system power source, particularly 
in battery-powered systems. 


Table 1 lists and briefly describes several 12V genera- 
tion solutions available at the time this document was 
published. This is by no means an exhaustive list, and 
does not reflect any specific recommendation by Intel 
Corporation. For in-depth information on power sup- 
ply solutions for flash memory, reference Intel applica- 
tion note AP-357 (order number 292092), available 
through your local Intel sales office or distributor. 


Controlling Vpp to 28FOO8SA Component(s) 


Once 12V is available in the system, how is it con- 
trolled? One approach is to hard-wire 12V from the 
supply directly to the Vpp inputs of each 28FOO8SA in 
the system. The advantage here is in design simplicity 
and board space savings. The 28FOO8SA Command 
User Interface architecture and two-step byte write/ 
block erase command sequences provide protection 
from unwanted data alteration even with high voltage 
present on Vpp. All 28FOO8SA functions are disabled 
with Vcc below lockout voltage V. Ko (2.2V), or when 
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RP# is at Vy, (see section 2.3). This provides data 
protection during system powerup, when the minimal- 
ly-loaded Vpp supply often ramps to 12V before Vcc 
(and therefore control inputs to the device) are stable. 


For additional data protection, the system designer can 
choose to make the Vpp supply switchable via a GPIO 
(General Purpose Input/Output) line, enabling 12V to 
the 28FOO8SA only during byte write or block erase 
attempts. A switchable Vpp also minimizes power con- 
sumption by both the flash memory components and 
the 12V supply or converter (due to efficiency losses). 
Many 12V converters integrate an ENABLE input, 
eliminating external circuitry. If such an input is not 
available, a low drain-source resistance MOSFET 
switch such as the Motorola MTD4P05 can be used at 
the 12V supply output. An example schematic for this 
switch is shown in Figure 3. The calculations below 
show that the low drain-source resistance of the 
MTD4P05 will keep a 12V input within the 5% toler- 
ance required by the 28FOO8SA. 


Rps = 0.69 


Ipp = 60 mA 


(worst case, two components being byte written or 
block erased) 


AVswitcH DROP = (60 mA xX 0.62) = 0.04V 


MTD4P05 
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Figure 3. Vpp Switch Schematic 


Table 1. 12V Conversion Solutions for Vpp 


Part Input Current 


Total 
Components 


}Maxin ==———Ss«s|s MAAX722 4to7.5 | 16SOIC | 120mA 
Linear Technology LT1110-12 | 4.5to55 | SOB | 120 mA 


‘Linear Technology | urrv0e.t2 | 451055 _ 
Tota __———~+; Mcadoeaa | 451055 
rMaxim =i MAX67 | ta.t10 165 
‘Linear Tectnotogy —_[uTtinit2 | 161080 
[National Semiconductor | umaseocT.12 | 191028 | To-220 | 10 


sos | 60m 
sos | 120 mA 
soe | 120 mA 
sos | 120 mA 
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2.2 RY/BY # (Ready/Busy) Output 


The 28FO08SA offers similar automated byte write/ 
block erase capabilities to those first seen in the 
28F001BX Bootblock flash memory family, introduced 
by Intel in May of 1991. It enhances these capabilities 
via the RY/BY # output, which provides hardware in- 
dication of internal Write State Machine (WSM) opera- 
tion. RY/BY # is a full CMOS output, constantly driv- 
en by the 28FOO8SA and not tristated if the device 
CE# or OE# inputs are brought to Vi. RY/BY #’s 
default state after device powerup is Voy. It transitions 
low to Voz when a byte write or block erase sequence 
is initiated by system software, and RY/BY #’s rising 
edge (return to Voy) alerts the system to byte write or 
block erase completion. RY/BY# also goes to Voy 
after the 28FOO8SA is put in Erase Suspend or Deep 
Powerdown modes. 


RY/BY # is intended to interface the 28FOO8SA to a 
system microprocessor rising-edge-triggered interrupt 
input. In a multiple-chip memory array, external 
EPLD logic or an interrupt controller can be used to 
combine and prioritize RY/BY #s into one system in- 
terrupt (see Figure 4). The system can then, using a 
flash memory “activity table” set up in RAM, poll the 
individual 28FOO8SA Status Registers to determine 
which device has returned “ready”, or read the 
RY/BY # inputs directly at the EPLD, as shown. 


Figure 5 provides an alternative method for connecting 
multiple RY/BY #s to one interrupt input. The diode/ 
resistor combination converts the 28FO0O8SA full 
CMOS output into an open-drain “‘wired-OR” equiva- 
lent. Any RY/BY# at Voy, will drive the interrupt 
input low, and this input is pulled high by the resistors 
when all RY/BY#s are at Von. It is important in a 
design like this to use diodes with low forward voltage 
drops, so that the 28FOO8SA Voy (0.45V) plus the di- 
ode voltage drop is still less than or equal to the desti- 
nation input Vy (0.8V). For the schematic shown in 
Figure 5, the equation is: 


Vo. + Vpiope = 0.45 Vmax + 0.3V = 0.75V < 0.8V 


Note that should the system connect RY/BY # to an 
interrupt, disable that interrupt prior to suspending 
erase, as RY/BY# will transition to Voy when the 
device is suspended. 
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Figure 4. EPLD-Based RY/BY # Implementation 


| 
MBD301 1 28F008SA 
RY /BY# 


= | 
MBD301 1 28FO08SA 
RY/BY# 


a 
MBD301 1 28F008SA 
RY /BY# 
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Figure 5. “Wired-OR” RY/BY # Implementation 


2.3 RP# (Reset/Powerdown) Input 


Deep Powerdown Mode 


The RP# input, when driven to Vy, by the system, 
switches the 28FOO8SA into a deep powerdown mode 
with negligable power consumption. This feature inte- 
grates the Vcc power FET often used with low power 
designs. Power consumption thru Vcc is typically 
1 pW in deep powerdown mode. RP #-low deselects 
the memory, places output drivers for Do_7 in a high- 
impedence state and turns off a majority of internal 
circuits. RY/BY# is driven to Voy while in deep 
powerdown mode. Depending on the flexibility desired, 
system designers can choose to put either the entire 
flash device array into deep powerdown mode, or any 
individual components via selective input control. The 
28FOO8SA requires a “wakeup” time after RP# re- 
turns to Vy before it can be successfully written 
(tpHwL) Or outputs are valid to read attempts (tpyqQv). 


+) 

intel. 

Write Protection 

Since RP# = Vjz deselects the 28FOO8SA, this input 
can be used not only as a means of entering deep pow- 
erdown mode but also as an active-high “chip enable” 
to block spurious writes during system power tran- 
sitions. Figure 6 shows one possible RP # implementa- 
tion, controlled by a GPIO line for power management 
and by a system POWER GOOD for power sequencing 
protection. In this design, the 5V monitoring circuit 
begins functioning at Vcc = 1V, and will enable the 
device only after Vcc transitions above 4.6V (and sys- 
tem control signals are therefore stable). As Vcc drops 


below 4.6V during system powerdown, RP ¥ protection 
is again activated. 


MAX70S POWERGOOD 


RP#(TO 28FO008SA) 
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Figure 6. RP # Gating 


Reset Control 


RP# at Vy, resets all internal automation within the 
28FOO8SA as part of the deep powerdown process. 
Upon exit from deep powerdown, the 28FOO8SA is re- 
set to Read Array mode. This functionality is ideal 
when the 28FOO8SA is the boot memory for the system. 
RP# active transitions reset the Write Status Machine 
if system reset occurs during flash memory program or 
erase, and allow successful CPU reboot. 


2.4 WE# (Write Enable) Input 


When flash memory is written, the result can range 
from a 28FOO8SA that is placed in “read intelligent 
identifier” or “read Status Register’ modes to altera- 
tion of nonvolatile flash memory contents. System 
hardware can prevent spurious writes to flash memory 
by application software or an operating system by gat- 
ing the system WE# to flash memory components to 
enable writes only when desired. 


Figure 7 shows a simple design that gates WE# witha 
GPIO line, enabling writes to the 28FOO8SA only when 
the GPIO is a “0”. The GPIO is initialized to “1” on 
system powerup and the BIOS, a dedicated update soft- 
ware routine, a special keyboard sequence, switch on 
the back of the system or jumper on the system mother- 
board can then control the GPIO. This circuit ensures 
that flash memory contents are as permanent as 
“ROM” unless alteration is specifically desired. 
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Figure 7. WE# Gating 


2.5 High Density/In2 Layout 


Figure 8 shows an 8 Mbyte flash memory array using 
TSOP (Thin Small Outline)-packaged 28FOO8SAs in 
standard (E) and reverse (F) configurations. A layout 
like this is used in Intel’s Series 2 flash memory cards 
(in densities to 20 Mbytes) and provides optimum array 
density for available board space. 


Address and data lines are connected to all components 
in parallel OE# and WE# are similarly connected. 
Section 2.7 of this document discusses alternate meth- 
ods of implementing these signals for highest speed 
reads and writes in large memory arrays. 


Component RY/BY #s are shown as not connected in 
Figure 8. They can be left unused, in which case the 
system software will substitute polling of component 
Status Registers for hardware interrupt, or RY/BY #s 


- can be implemented as described in section 2.2. 


CE#s are also not connected, intended to be individu- 
ally driven by system chip enable decoding logic. This 
provides capability to read from and write to the array 
on a byte-by-byte basis. In a x16-only system, upper 
and lower byte 28FOO8SAs can have their CE#s bused 
together if desired. 


Finally, Vcc, Vpp and RP# are connected in parallel 
to all components. Section 2.6 discusses bypass capaci- 
tor filtering of supply voltage inputs, while section 2.3 
provides uses for RP#. If desired, individual compo- 
nent, component pair, etc. selective powerdown control 
can be substituted for the global control shown in 
Figure 8. 


In space-constrained designs, a multiple-layer partial 
“serpentine” trace layout at the edges of the 28FOO8SA 
array may be implemented, with a full serpentine lay- 
out within the array as in Figure 8. 


3-111 


AP-359 | | | i ntel ; 


UT 


VS800418724 VS80048723 


Saas 
I, 


4 cE PAD 


Lc 


E28FOO8SA F28FO08SA 


UT 


- 


TOC 


F28FOO8SA 


| 


VS80048724 


a 


E28FO08SA 


CT 


292094-8 


Figure 8. TSOP Serpentine Layout 


2.6 Power Supply Decoupling Assumptions: 


35 mA per device (Vcc), therefore 
17.5 mA per device input (Vcc) 


Both the Vcc and Vpp inputs to each 28FOO8SA | 
should be decoupled at the package leads to provide 
noise immunity and supply current for transient cur- | = 30 mA per device (Vpp) 
rent spikes during read, byte write and block erase. Ad- dv = 0.1V (0.2V peak-peak) 
ditional bulk capacitance for groups of flash memories 

overcomes voltage slump caused by PC board trace in- dt = 20 ns 
ductances. Calculations for individual component and 
bulk capacitors (one per 8 devices) are shown below. 


Per-Component-Input Decoupling Capacitor (Vcc): 
Basic Equation: C = | dt/dv = (17.5 mA X 20 ns)/0.1V = 3.5 nF 
| = C dv/dt 4x margin = 4 X 3.5 nF = 14 nF 


Standard Equivalent = 0.01 uF 
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NOTE: 
Calculations above assume that each 28FO08SA is 
driving CMOS inputs (with corresponding high im- 
pedance and negligible input current requirements). If 
28FOO8SA outputs are driving non-CMOS inputs, 


larger per-component capacitance may be needed to 
supply current while outputs are switching. 


Bulk Capacitor (Vcc): 
C = 10 X (Total of Decoupling Capacitors) 


Bulk Capacitor (4 Mbyte array) 10 x (8 X 0.01 pF) 


0.8 uF 


Standard Equivalent = 1 »F 
Per-Component Decoupling Capacitor (Vpp): 
= | dt/dv = (80 mA X 20 ns)/0.1V = 6 nF 
4x margin = 4 X 6 nF = 24nF 


Standard Equivalent = 0.033 yF 


2.7 High Speed Design Techniques 


The 28FO08SA’s fast read access and command write 
specifications make it a natural choice for high per- 
formance memory arrays. The following tips will opti- 
mize the memory interface for optimum read/write 
speed. The common recommendation in all instances 
centers around minimizing fanout and capacitive bus 
loading to allow highest switching speed, lowest rise 
and fall times, and therefore greatest performance. 


ADDITIONAL INFORMATION 


28F008SA Datasheet 
28F008SA-L Datasheet 


AP-357 “Power Supply Solutions for Flash Memory 
AP-360 “28F008SA Software Drivers” 

AP-364 ‘“28FO08SA Automation and Algorithms” 
ER-27 “The Intel 28FOO8SA Flash Memory” 
ER-28 “ETOX-IIl Flash Memory Technology” 
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@ Minimize address bus loading from the microproc- 
essor to the memory array. Multiple address latches 
feeding subsets of the array speed address input to 
each 28FOO8SA and CE# decoding by external log- 
ic. 


e Similarly, drive the memory array with multiple 
OE#s and WE#s. Most EPLD and discrete logic 
timing is specified at a 30 pF load, which equates to 
driving 4 28FOO8SA inputs at maximum input ca- 
pacitance. Anything more than this may severely 
impact the logic’s propagation delay. 

e Finally, remember that each 28FOO8SA, when read, 
drives not only the system microprocessor or trans- 
ceiver but also any other flash memory components 
connected to the common data bus. Each 28FOO8SA 
data output is specified at 12 pF, and the 28FOO8SA 
read timings are tested at either 30 pF or 100 pF of 
loading, depending on the chosen speed bin. 


For large flash arrays where sequential data can be dis- 
tributed on many devices, hardware interleaving pro- 
vides additional performance. 


2.8 Example Bus Interfaces 


Appendix A shows hardware interface to the In- 
tel386TMSL PI bus, and Appendix B shows interface to 
the Intel486™SX local CPU bus. Both interfaces in- 
corporate techniques described in sections 2.1-2.7 of 
this document. These designs are intended to be exam- 
ples which can be modified to suit requirements of the 
end system. 


Order Number 
290429 
290435 
292092 
292095 
292099 
294011 
294012 
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APPENDIX A 
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NOTE: 
The DRAM interface is not shown, for graphic simplicity. 
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APPENDIX B 
Intel486™ SX LOCAL CPU BUS INTERFACE 
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NOTE: 
The DRAM interface is not shown, for graphic simplicity. 


REVISION HISTORY 
Description 
Renamed PWD# as RP# to match JEDEC conventions. 


Updated Figure 6 
Added Reset Control discussion for RP # (Reset/Powerdown) Input. 
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1.0 INTRODUCTION 


This application note provides example software code 
for byte writing, block erasing and otherwise control- 
ling Intel’s 28FOO8SA 8 Mbit symmetrically blocked 
FlashFileTM Memory family. Two programming lan- 
guages are provided; high-level “C” for multi-platform 
support, and ASM-86 assembly. In many cases, the 
driver routines can be inserted “as is” into the main 
body of code being developed by the system software 
engineer. The text accompanying each routine describes 
the existing code and suggests area for possible altera- 
tion to fit specific applications. These explanations, 
along with in-line commenting, minimize driver modifi- 
cation efforts. 


3-118 


a 

intel. 
Companion product datasheets for the 28FOO8SA and 
28FO08SA-L are valuable reference documents. Data- 
sheets should be reviewed in conjunction with this ap- 
plication note for a complete understanding of the de- 
vices. AP-359, “28FOO8SA Hardware Interfacing” is 
the hardware-oriented application note equivalent for 
these devices and can also be referenced. AP-364 
“28FO08SA Automation and Algorithms’, another 


useful reference, discusses the details of Write State ma- 
chine automation. 


The internal automation of the 28FOO8SA makes soft- 
ware timing loops unnecessary and results in platform- 
independent code. This software is designed to be exe- 
cuted in any type of memory and with all processor 
clock rates. ““C’? code can be used with many micro- 
processors and microcontrollers, while ASM-86 assem- 
bly code provides the smallest code “kernal” for Intel 
microprocessors and embedded processors. 


intel | AP-360 


2.0 ASM-86 DRIVERS 


Copyright Intel Corporation, 1992 
Brian Dipert, Intel Corporation, February 8, 1992, Revision 1.0 


Revision History: Rev 1.0 


The following code controls byte write of data to a single 28FO08SA (x8 write) 
DS:[SI] points to the data to be written, ES:[DI] is the location to be written 
In protected mode operation, DS and ES reference a descriptor 

Register AX is modified by this procedure 


we we we we 


WRITE_SETUP EQU 40H 
READ_ID EQU 90H 
INTEL_ID EQU 89H 
DEVICE_ID EQU OA2H 
DEVICE_ID2 EQU OA1H 
READY EQU 80H 
W_ERR_FLAG EQU 10H 
VPP_FLAG EQU 08H 
H Insert code here to ramp Vpp and disable component RP# input. If a string of bytes is 
‘ to be written at one time, Vpp ramp to 12V and ID check need only occur once, 
: before the first byte is written 
MOV AX, "Address O for target 28F008SA-segment" 
; Initialize pointer to 28FOO08SA address 0 
MOV ES, AX 
MOV DI, "Address 0 for target 28F008SA-offset" 
MOV BYTE PTR ES:[DI], READ_ID ; Write Inteligent Identifier command 
CMP BYTE PTR ES:[DI], INTEL_ID ; Does manufacturer ID read correctly? 
JNZ W._BYT_ID_ERR 
MOV DI, "Address l for target 28FO008SA-offset" 
; Initialize pointer to 28FO08SA address l 
CMP BYTE PTR ES:[DI], DEVICE_ID ; Does device ID read correctly? 
JZ WIBYT.ID.PASS 
CMP BYTE PTR ES:[(DI], DEVICE_ID2 
JINZ W.BYT_ID_ERR 


MOV AX, "Byte write destination address-segment" 
; Initialize pointer to byte write dest. address 


MOV ES, AX 
MOV DI, "Byte write destination address-offset" 
MOV BYTE PTR ES:[DI], WRITE_SETUP ; Write byte write setup command 
MOV AL, DS: [SI] ; Load AL with data to write 
MOV ES:([DI], AL ; Write to device 
W.BYT_LOOP: 
TEST BYTE PTR ES:[DI], READY ; Read 28F008SA Status Register 
JZ W.BYT_LOOP ; hoop until hit 7 = 1 
TEST BYTE PTR ES:[DI], (WLERR.FLAG OR VPP_FLAG) 
JZ W.BYT_CONT ; Success! 
TEST BYTE PTR ES:[(DI], W.ERR_FLAG ; Check Status Register bit 4 
JINZ W_BYT_ERR ; Jump if = 1, Byte Write Error 
TEST ES:([DI], VPP.FLAG ; Check Status Register bit 3 
JNZ W_BYT_VPP ; Jump if = 1, Vpp Low Error 
W.BYT_ID_ERR: 
: Insert code to service improper device ID read error here. 
. Is 28FO08SA RP# input disabled? Is Vcc applied to the 28F008SA? 
W_BYT_ERR: 
‘ Insert code to service byte write error here 
W_BYT_VPP: 
‘ Insert code to service byte write Vpp low error here 
W.BYT_CONT: 
H Code continues from this point..... 


This routine writes a byte of data to a single 283FOO8SA. Note the use of BYTE PTR notation to force x8 accesses. If 
_a string of bytes is to be written at one time, the Vpp ramp up, RP# disable and device ID checks need only be done 
before the first byte write attempt. Additionally, when writing multiple bytes at once, examination of bits other than 
bit 7 (WSM Status) need only occur after the last byte write has completed. The Status Register retains any error bits 
until the Clear Status Register command is written. 


/ 
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we we we we 


WRITE_SETUP 
READ_ID 
INTEL.ID 
DEVICE_ID 
DEVICE_ID2 


MOV 


MOV 
MOV 
MOV 


CMP 


JNZ 
MOV 


CMP 


JZ 
CMP 
JNZ 


W.WRD_ID_PASS: 
MOV 


MOV 
MOV 
MOV 
MOV 
MOV 
W.WRD_LOOP : 

TEST 
JZ 


TEST 
JZ 


MOV 
TEST 
JNZ 
TEST 
JNZ 


TEST 
JNZ 
TEST 
JNZ 


W.WRD_ID_ERR: 


we we 


W_WRD_ERR : 
W_WRD_VPP: 


W.WRD_CONT: 


EQU 


The following code controls byte write of data to a pair of 28F008SAs (xl6 write) 
DS:[SI] points to the data to be written, ES:[DI] is the location to be written 
In protected mode operation, DS and ES reference a descriptor 

Register AX is modified by this procedure 


40H 


08H 


Insert code here to ramp Vpp and disable component RP# inputs. If a string of words is 


to be written at one time, Vpp ramp to 12V and ID check need only occur once, 
before the first word is written 


AX, “Address 0 for target 28F008SA-segment" 

; Initialize pointer to 28FOO8SA address 0 
ES, AX 
DI, "Address 0 for target 28F008SA-offset" 
ES:[DI], ((READLID SHL 8) OR READ ID) 

; Write Inteligent Identifier command 
ES:([DI], ((INTEL.ID SHL 8) OR INTEL ID) 

; Does manufacturer ID read correctly? 
W.WRD_ID_ERR 
Di. "Address 1 for target 28FO08SA-offset" 

; Initialize pointer to 28FO0O8SA address 1 
ES:{[DI], ((DEVICELID SHL 8) OR DEVICE_ID) 


; Does device ID read correctly? 


W.WRD_ID_PASS 


ES:([DI], ((DEVICE_ID2 SHL 8) OR DEVICE_ID2) 
W_WRD_ID_ERR 
AX, "Byte write destination address-segment" 
; Initialize pointer to byte write dest. address 
ES, AX 
DL. "Byte write destination address-offset" 
ES:[DI], ((WRITEL_SETUP SHL 8) OR WRITE_SETUP) ; Write byte write setup command 


DS:[S1] ; Load AX with data to write 
AX ; Write to devices 


ES:[DI], ((READY SHL 8) OR READY) ; Read 28F008SA Status Registers 
W_WRD_LOOP ; Loop until bit 7=1 

ES:{DI], (((WLERR_.FLAG OR VPP_.FLAG) SHL 8) OR (WLERR FLAG OR VPP_FLAG) ) 
W_WRD_CONT ; Success! 

AX, ES:[DI] ; Load Status Register data into AX 

AL, W_ERR_FLAG ; Check Status Register bit 4 (low byte) 
W_WRD_ERR ; Jump if = 1 

AH, W_ERR_FLAG ; Check Status Register bit 4 (high byte) 
W_WRD_ERR . Jaume if = 1 

AL, VPP_FLAG ; Check Status Register bit 3 (low byte) 
W_WRD_VPP ; Jump if = l 

AH, VPP_FLAG ; Check Status Register bit 3 (high byte) 
W_WRD_VPP ‘ Jump tf: s-1 


Insert code to service improper device ID read error here. 
Are 28F008SA RP# inputs disabled? Is Vcc applied to the 28F008SAs? 


Insert code to service byte write error here 


Insert code to service byte write Vpp low error here 


; Code continues from this point..... 


This routine writes a word of data to a pair of 28FOO8SAs. Note that all constants have been “OR’d” for parallel 
read/write of two devices at once. If a string of words is to be written at one time, the Vpp ramp up, RP# disable 
and device ID checks need only be done before the first word write attempt. Additionally, when writing multiple 
words at once, examination of bits other than bit 7 (WSM Status) need only occur after the last word write has 


completed. The Status Register retains any error bits until the Clear Status Register command is written. 
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The following code controls block erase of a single 28FO08SA (x8 block erase) 


ES:[DI] points to the block to be erased 


In protected mode operation, ES references a descriptor 
Register AX is modified by this procedure 


ERASE_SETUP EQU 20H 
ERASE_CONFIRM EQU ODOH 
READ_ID EQU 90H 
INTEL_ID EQU 89H 
DEVICE_ID EQU OA2H 
DEVICE_ID2 EQU OA1H 
READY EQU 80H 
E_ERR_FLAG EQU 20H 
E.CMD_FLAG EQU 50H 
VPP_FLAG EQU 08H 


Insert code here to ramp Vpp and disable component RP# input. If a string of blocks is 
to be erased at one time, Vpp ramp to 12V and ID check need only occur once, 
before the first block is erased 

MOV AX, "Address 0 for target 28F008SA-segment" 

; Initialize pointer to 28FO08SA address 0 


MOV ES, AX 
MOV Di, "Address 0 for target 28FO008SA-offset" 
MOV BYTE PTR ES:[DI], READ_ID ; Write Inteligent Identifier command 
CMP BYTE PTR ES:[DI], INTEL_ID ; Does manufacturer ID read correctly? 
JINZ E_BYT_ID_ERR 
MOV DI, "Address 1 for target 28F008SA-offset" 
; Initialize pointer to 28F008SA address l 
CMP BYTE PTR ES:[DI], DEVICE_.ID ; Does device ID read correctly? 
JZ E.BYT_ID_PASS 
CMP BYTE PTR ES:[DI], DEVICE_ID2 
JINZ E_BYT_ID_ERR 
E_BYT_ID.PASS: 
“ MOV AX, "Block erase destination address-segment" 
; Initialize pointer to block erase dest.address 
MOV ES, AX 
MOV DI, "Block erase destination address-offset" 
MOV BYTE PTR ES:[DI], ERASE_SETUP ; Write block erase setup command, 
MOV BYTE PTR ES:[(DI], ERASE_CONFIRM ; Write block erase confirm command 
E_BYT_LOOP: 
TEST BYTE PTR ES:[DI], READY ; Read 28FOO008SA Status Register 
JZ E_BYT_LOOP : Loop until bit. 7 = 1 
TEST BYTE PTR ES:[DI], (E_.CMD_FLAG OR VPP_FLAG) 
JZ E_BYT_CONT ; Success! 
TEST BYTE PTR ES:[DI], E_CMD_FLAG ; Check Status Register bits 4 and 5 
JNZ E_BYT_CMD_ERR ; Jump if = l 
TEST BYTE PTR ES:[DI], ELERR_FLAG ; Check Status Register bit 5 
JINZ E_BYT_ERR ; dump if = 1 
TEST BYTE PIR ES:[DI], VPP_FLAG ; Check Status Register bit 3 
JINZ E.EYT.Vre - Jim if = i 


BYT_ID_ERR: 


BYT_ERR: 
E_BYT_VPP: 


E_BYT_CONT 


E. 
E_BYT_CMD_ERR: 
E. 


Insert code to service improper device ID read error here. 
Is 28FO08SA RP# input disabled? Is Vcc applied to the 28F008SA? 


Insert code to service block erase command sequence error here 
(setup followed by a command other than confirm) 


Insert code to service block erase error here 
Insert code to service block erase Vpp low error here 


Code continues from this point..... 


This routine erases a block of a single 23FOOSA. Note the use of BYTE PTR notation to force x8 accesses. If a string 
of blocks is to be erased at one time, the Vpp ramp up, RP# disable and device ID checks need only be down before 
the first block erase attempt. Additionally, when erasing multiple blocks at once, examination of bits other than bit 7 
(WSM Status) need only occur after the last block erase has completed. The Status Register retains any error bits 
until the Clear Status Register command is written. 
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The following code controls block erase of a pair of 28FO008SAs (xl6 block erase) 
ES:[DI] points to the blocks to be erased 

In protected mode operation, ES references a descriptor 

Register AX is modified by this procedure 


ERASE. SETUP EQU 20H 
ERASE. CONFIRM EQU ODOH 
READ_ID EQU 90H 
INTEL_ID EQU 89H 
DEVICE_ID EQU OA2H 
DEVICE_ID2 EQU OA1H 
READY EQU 80H 
E_ERR_FLAG EQU 20H 
E.CMD_FLAG EQU 30H 
VPP_FLAG EQU 08H 
: Insert code here to ramp Vpp and disable component RP# inputs. If a string of blocks is 
; to be erased at one time, Vpp ramp to 12V and ID check need only occur once, 
: before the first block pair is erased 
MOV AX, "Address O for target 28F008SA-segment” 
; Initialize pointer to 28FO08SA address 0 
MOV ES, AX 
MOV DI. “Address 0 for target 28F008SA-offset" 
MOV ES:[DI], ((READ.ID SHL 8) OR READ_ID) 
; Write Inteligent Identifier command 
CMP ES:([DI], ((INTEL.ID SHL 8) OR INTEL_ID) 
; Does manufacturer ID read correctly? 
JINZ E_WRD_ID_ERR 
MOV Dis "Address l for target 28FO08SA-offset" 
; Initialize pointer to 28F008SA address l 
CMP ES:[([DI], ((DEVICEL.ID SHL 8) OR DEVICE_ID) 
; Does device ID read correctly? 
JZ E_WRD_ID_PASS 
CMP ES:[DI], ((DEVICE_ID2 SHL 8) OR DEVICE_ID2) 
JINZ E_WRD_ID_ERR 
E_.WRD_ID_PASS: 
MOV AX, "Block erase destination address-segment" 
a ; Initialize pointer to block erase dest. address 
MOV ES, AX 
MOV DI, "Block erase destination address-offset" 
MOV ES:[DI], ((ERASE.SETUP SHL 8) OR ERASE_SETUP) 
; Write block erase setup command 
MOV ES:[DI], ((ERASE.CONFIRM SHL 8) OR ERASE_CONFIRM) 
; Write block erase confirm command 
E.WRD_LOOP: 
TEST ES:[DI], ((READY SHL 8) OR READY) ; Read 28FO0O8SA Status Registers 
JZ E.WRD_LOOP ¢ Loop until bit 7 = 1 
TEST ES:[DI], (((E.CMD.FLAG OR VPP_FLAG) SHL 8) OR (E.CMD.FLAG OR VPP_FLAG) ) 
JZ E.WRD.CONT ; Success! 
MOV AX, ES:[DI] ; Load Status Register data into AX 
TEST AL, E._CMD_FLAG ; Check Status Reg bits 4 and 5 (low byte) 
JNZ E_WRD_CMD_ERR Jump if = 1 
TEST AH, E.CMD_FLAG ; Check Status Register bits 4 and 5 (high byte) 
JNZ E_WRD_CMD_ERR * Jump if = i 
TEST AL, E_ERR_FLAG ; Check Status Register bit 5 (low byte) 
JINZ E_WRD_ERR ; Jump if = 1 
TEST AH, E_ERR FLAG ; Check Status Register bit 5 (high byte) 
JNZ E_WRD_ERR . Jump ifs 1 
TEST AL, VPP_FLAG ; Check Status Register bit 3 (low byte) 
JINZ E_WRD_VPP s Jump if = 1 
TEST AH, VPP_FLAG ; Check Status Register bit 3 (high byte) 
JINZ E.WRD_VPP ; Jump if = 1 


E.WRD_ID_ERR: 


Insert code to service improper device ID read error here. 
Are 28F008SA RP# inputs disabled? Is Vcc applied to the 28FO08SAs? 


E.WRD.CMD_ERR : 


: Insert code to service block erase command sequence error here 


E_WRD_ERR : 


(setup followed by a command other than confirm) 


. Insert code to service block erase error here 


E_WRD_VPP: 


E_WRD_CONT: 


: Code continues from this point..... 
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Insert code to service block erase Vpp low error here 
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This routine erases a block pair of two 28FOO8SAs. Note that all constants have been “OR’d” for parallel read/write 
of two devices at once. Ifa string of block pairs is to be erased at one time, the Vpp ramp up, RP # disable and device 
ID checks need only be done before the first block pair erase attempt. Additionally, when erasing multiple block 
pairs at once, examination of bits other than bit 7 (WSM Status) need only occur after the last block pair erase has 
completed. The Status Register retains any error bits until the Clear Status Register command is written. 
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/* Copyright Intel Corporation, 1992 */ 
/* Brian Dipert, Intel Corporation, May 7, 1992, Revision 2.1 */ 
/* The following drivers control the Command and Status Registers of the 28FO008SA Flash */ 
/* Memory to drive byte write, block erase, Status Register read and clear and */] 
/* array read algorithms. Sample Vpp and RP# control blocks are also included, */ 
/* as are example programs combining drivers into full algorithms ud 
/* The functions listed below are included: */ 
/* erasbgn(): Begins block erasure a J 
/* erassusp(): Suspends block erase to allow reading data from a block of the */ 
/* 28F008SA other than that being erased */ 
/* erasres(): Resumes block erase if suspended al J 
/* end(): Polls the Write State Machine to determine if block erase or byte write fi 
/* have completed a 
f* eraschk(): Executes full status check after block erase completion */ 
f* writebgn(): Begins byte write */] 
/* writechk(): Executes full status check after byte write completion */ 
/* idread(): Reads and returns the manufacturer and device IDs of the target */ 
/* 28F008SA */ 
/* statrd(): Reads and returns the contents of the Status Register */ 
/* Statclr(): Clears the Status Register a 
| fs rdmode (): Puts the 28FO08SA in Read Array mode */ 
/* rdbyte (): Reads and returns a specified byte from the target 28F008SA */ 
/* vppup(): Enables high voltage Vpph */ 
/* : vppdown(): Disables Vpph */ 
sf? pwden(): Enables active low signal RP# */ 
/* pwddis(): Disables active low signal RP# */ 
/* */ 
Y ha Addresses are transferred to functions as pointers to far bytes (ie long integers). An */ 
/* alternate approach is to create a global array the size of the 28FO08SA and * 
/* located "over" the 28FO08SA in the system memory map. Accessing specific */ 
hd locations of the 28F008SA is then accomplished by passing the chosen function */ 
/* an offset from the array base versus a specific address. Different */ 
j* microprocessor architectures will require different array definitions; ie for */ 
/* the Intel architecture, define it as "byte eightmeg[16][10000]" and pass each */ 
/* function TWO offsets to access a specific location. MCS-96 architectures are */ 
/* limited to “byte eightmeg[10000]"; alternate approaches such as using port pins */ 
/* for paging will be required to access the full flash array */ 
/* a J 
/* To create a far pointer, a function such as MK_FP() can be used, given a segment and */ 
/* offset in the Intel architecture. I use Turbo-C; see your compiler reference */ 
so manual for additional information. */ 


J SFOs SSS SEIS EEE FSS SSSR SS SESS OES SS FPS SSCS ESSE USP STE SS SEL SS SINE SES HSS CESS SOS FH CESS SSPE SPAS SSIES / 


fPESS SESS SOSOOERECR SESS SSR ESH SE SLSR SPSS SAE SSE ASSET ERIS SSR SSS SOHNE SS SES CASS SSS CESSES AES SSSA SSS / 


/* Revision History: Rev 2.1 */ 
$a a 
/* Changes From Revision 1.0 to Revision 2.0: al | 
/* Added alternate 28FO08SA device ID to routine idread() */ 
/* sf 
sf? Changes from 2.0 to 2.1: Revised the Erase Suspend algorithm to remove potential */ 
/* “infinite loop" caused by the WSM going “ready” after the system reads the */ 
/* Status Register, and before the system issues the Erase Suspend command */ 


fESPEOSESSSEL ES ESSE ELLE CES LS SEE SPE SELES SSS SESS ESSE FEES SESSL ISS SS SESE LST ES ESSE ESS SSS SELES SS SPST ES SEIS TS 


typedef unsigned char byte; 
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{* Function: Main sa 
/* Description: The following code shows examples of byte write and block */ 
7* erase algorithms that can be modified to fit the specific application and */ 
/* hardware design oh x 
JSP ET OF ESS TSS SSESE TES SHESE SESS SS TESS ESS EHTS ESSE SESELESS LFS VERS SESS ESSIAS ESSE SHOES ES SOSH SER ER TASS ECEST TS / 
ee 
byte far *address; 
byte data,status; 
/* The following code gives an example of a possible byte write algorithn. */ 
/* Note that Vpp does not need to be cycled between byte writes when a string of byte */ 
/* writes occurs. Ramp Vpp to 12V before the first byte write and leave at 12V until after */ 
i eae completion of the last byte write. Doing so minimizes Vpp ramp up-down delay and */ 
/* maximizes byte write throughput *f 
vppup() ; 
/* "INSERT SOFTWARE DELAY FOR VPP RAMP IF REQUIRED" +) 
pwddis() ; 
address = OXxxxxxL ; 
data = OXyy; 
if (writebgn(data,address) == 1) 
/* "RECOVERY CODE-POWER NOT APPLIED (ID CHECK FAIL)" *7 
else 
{ 
while (end(&status) ) 
switch (writechk(status) ) 
{ 
case 0: 
break; 
case l: 
/* "RECOVERY CODE-VPP LOW DETECT ERROR" */ 
break; 
case 2:3 
f* "RECOVERY CODE-BYTE WRITE ERROR" ays 
break ; 


} 
statolr() ; 
} 
vppdown() ; 


This “‘C”’ routine gives an example of combining lower-level functions (found in following pages) to complete a byte 


write. Routines vppup( ) and pwddis( ) enable the 28FOO8SA for byte write. Function writebgn( ) issues a byte write 
sequence to the device, end( ) detects byte write completion via Status Register bit 7, and writechk( ) analyzes Status 
Register bits 3—6 to determine byte write success. If a string of bytes is to be written at one time, Vpp ramp up and 
RP# disable need only be done before the first byte write attempt. Additionally, when writing multiple bytes at 
once, examination of bits other than bit 7 (WSM Ready) need only occur after the last byte write has completed. The 


Status Register retains any error bits until the Clear Status Register command is written. 
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a 
/* The following code gives an example of a possible block erase algorithm. */ 
/* Note that Vpp does not need to be cycled between block erases when a string of block a! J 
/* erases occurs. Ramp Vpp to 12V before the first block erase and leave at 12V until after tj 
/* completion of the last block erase. Doing so minimizes Vpp ramp up-down delay and */ 
/* maximizes block erase throughput “y 
vppup () ; 
/* "INSERT SOFTWARE DELAY FOR VPP RAMP IF REQUIRED" */ 
pwddis(); 
address = OXxxxxxL ; 
if (erasbgn(address) == 1) 
f* , "RECOVERY CODE-POWER NOT APPLIED (ID CHECK FAIL)" , , 
else 
{ 
while (end(&sStatus) ) 
switch (eraschk(status) ) 
{ 
case 0: 
Y break ; 
case l: 
/* "RECOVERY CODE-VPP LOW DETECT ERROR" */ 
break ; 
case 2: 
/* "RECOVERY CODE-BLOCK ERASE ERROR" */ 
break ; 
case 3: 
/* "RECOVERY CODE-ERASE SEQUENCE ERROR" “7 
break ; 
} 
statclr(); 
j 
vppdown() ; 


This ‘‘C”’ routine gives an example of combining lower-level functions (found in following pages) to complete a block 
erase. Routines vppup( ) and pwddis( ) enable the 28FOO8SA for block erase. Function erasbgn( ) issues a block erase 
sequence to the device, end( ) detects block erase completion via Status Register bit 7, and eraschk( ) analyzes Status 
Register bits 3—6 to determine block erase success. If a string of blocks is to be erased at one time, Vpp ramp up and 
RP# disable need only be done before the first block erase attempt. Additionally, when erasing multiple blocks at 
once, examination of bits other than bit 7 (WSM Ready) need only occur after the last block erase has completed. 
The Status Register retains any error bits until the Clear Status Register command is written. 
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/* Function: Erasgbn 

j? Description: Begins erase of a block. 

/* Inputs: blekaddr: System address within the block to be erased 
/* Outputs: None 

/* Returns: 0O = Block erase successfully initiated 

/* 1 = Block erase not initiated (ID check error) 

/* Device Read Mode on Return: Status Register (ID if returns 1) 


fPPCESESSE SSE SS SASS FSA SESSA SS ESSE SSH SSS SESE S SESS ESE SHEL ESET SS SS ERE SSELE SAGES SESE SESS ESOS SS SEDSESOSESS ESS / 


#define ERASETUP 0X20 
#define ERASCONF OXDO 


int erasbgn(blckaddr) 
byte far *blckaddr; 


byte mfgrid, 


deviceid; 


/* Erase Setup command 


/* Erase Confirm command 


/* bleckaddr is an address within the block to be erased 


if (idread(&mfgrid,&deviceid)==1) /* ID read error; device not powered up? 
return (1); 


*blckaddr = 
*blckaddr = 
return (0); 


Routine erasbgn( ) issues a block erase command sequence to a 28FOO8SA. It is passed the desired system address for 
the block to be erased. After calling idread(), it writes the erase command sequence at the specified address. It 
returns “0” if block erase initiation was successful, and “1” if the ID read fails (device not powered up or RP# not 


disabled). 
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ERASETUP ; 
ERASCONF ; 


/* Write Erase Setup command to block address 
/* Write Erase Confirm command to block address 


sf 
a 


*y 


"7 


7 
*/ 
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/* Function: Erassusp of 
/* Description: Suspends block erase to read from another block as’ 
f* Inputs: None */ 
/* Outputs: None */ 
/* Returns: 0 = Block erase suspended */ 
/* 1 = Error; Write State Machine not busy (block erase suspend not possible) */ 
/* Device Read Mode on Return: Status Register wt 
JEFSTRELELESSEELELLAS RLAEAS SRLS CLE LER ELSES ESSLIESSLERS ILE LESS ALAA ESSS ASSESSES S SESLAECE PSSA OS SSIS HRS ASS Df 
#define RDYMASK 0X80 /* Mask to isolate the WSM Status bit of the Status Register */ 
#define WSMRDY 0X80 /* Status Register value after masking, signifying that */ 
/* the WSM is no longer busy */ 
#define SUSPMASK 0X40 /* Mask to isolate the erase suspend status bit of the */ 
/* Status Register */ 
#define ESUSPYES 0X40 /* Status Register value after masking, signifying that */ 
/* block erase has been suspended */ 
#define STATREAD 0X70 /* Read Status Register command */ 
#define SYSADDR 0 /* This constant can be initialized to any address within */ 
/* the memory map of the target 28F008SA and is 7s 
f* alterable depending on the system architecture at 
#define SUSPCMD OXBO /* Erase Suspend command */ 
int erassusp() 
{ 
byte far *stataddr; /* Pointer variable used to write commands to device 77 
Stataddr = (byte far *)SYSADDR; 
*stataddr = SUSPCMD; /* Write Erase Suspend command to the device */ 
*stataddr = STATREAD; /* Write Read Status Register command..necessary in case */ 
/* erase is already completed */] 
while ((*stataddr & RDYMASK) != WSMRDY) 
: /* Will remain in while loop until bit 7 of the Status */ 
/* Register goes to l, signifying that */ 
/* the WSM is no longer busy adj 
if ((*stataddr & SUSPMASK) = ESUSPYES) 
return (0); /* Erase is suspended. . return code "0" */ 
return (1); /*Erase has already completed; suspend not possible. */ 
/* Error code "1" *] 


Routine erassusp( ) issues the erase suspend command to a 28FOO8SA. It first makes sure the WSM is truly busy, 
then issues the erase suspend command and polls Status Register bits 7 and 6 until they indicate erase suspension. It 
returns “0” if block erase was successful, and “1” if the WSM was not busy when suspend was attempted. 
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/* Function: Erasres */ 
y* Description: Resumes block erase previously suspended a 
/* Inputs: None */ 
/* Outputs: None */ 
/* Returns: O = Block erase resumed */ 
J* 1 = Error; Block erase not suspended when function called */ 
/* Device Read Mode on Return: Status Register al! 
LPSESSESSSESSSESSE SS SELES SESELESLSESSESESHLSTESSSLSSSESKSSS SERESSSELSSSESSELELSSESESERSSESSSASSHSESSSESESEREKES & / 
#define RDYMASK 0X80 /* Mask to isolate the WSM Status bit of the Status Register */ 
#define WSMRDY 0X80 /* Status Register value after masking, Signifying that the */ 

/* WSM is no longer busy */ 
#define SUSPMASK 0X40 /* Mask to isolate the erase suspend status bit of the */ 

/* Status Register * / 
#define ESUSPYES 0X40 /* Status Register value after masking, signifying that bat J 

/* block erase has been suspended Ff 
#define STATREAD 0X70 /* Read Status Register command * 
#define SYSADDR 0 /* This constant can be initialized to any address within */ 

/* the memory map of the target 28FO08SA and is */ 

f* alterable depending on the system architecture */ 
#define RESUMCMD OXDO /* Erase Resume command */ 


int erasres() 


{ 


byte far *stataddr; /* Pointer variable used to write commands to device */ 
Stataddr = (byte far *)SYSADDR; 
*stataddr = STATREAD; /* Write Read Status Register command to 28FO08SA */ 
if ((*stataddr & SUSPMASK) != ESUSPYES) 
return (1); /* Block erase not suspended. Error code "1" */ 
*stataddr = RESUMCMD; /* Write Erase Resume command to the device */ 
while ((*stataddr & SUSPMASK) == ESUSPYES) 
: /* Will remain in while loop until bit 6 of the Status */ 
f* Register goes to 0, signifying block */ 
* erase resumption */ 
while ((*stataddr & RDYMASK) == WSMRDY) 
: /* Will remain in while loop until bit 7 of the Status of 
/* Register goes to 0, signifying that the WSM is */ 
/* once again busy */ 


return (0); 


Routine erasres( ) issues the erase resume command to a 28FOO8SA. It first makes sure the WSM is truly suspended, 
then issues the erase resume command and polls Status Register bits 7 and 6 until the indicate WSM resumption. It 
returns “0” if block erase resume was successful, and “1” if the WSM was not suspended when resumption was 
attempted. . 
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/* Function: End */ 
/* Description: Checks to see if the WSM is busy (is byte write/block erase completed?) */ 
/* Inputs: None ad 
f* Outputs: Statdata: Status Register data read from device */ 
/* Returns: O = Byte Write/Block Erase completed */ 
/* 1 = Byte Write/Block Erase still in progress *7 
' §* Device Read Mode on Return: Status Register */ 
JPCPSSSESSSES SES ESSSSS SHSSSTESSES ERE CESSES SS SHESRESEESOCEAS ESAS SAES EASE SEEDER ESSE SI NELES ERS GAARA SATA POSSESS J 
#define RDYMASK 0X80 /* Mask to isolate the WSM Status bit of the Status */ 
#define WSMRDY 0X80 /* Register value after masking, signifying that the */ 
7 WSM is no longer busy */ 

#define STATREAD 0X70 /* Read Status Register command *J 
#define SYSADDR 0 /* This constant can be initialized to any address within*/ 
/* the memory map of the target 28FOO8SA and is */ 

/* alterable depending on the system architecture */ 


int end(statdata) 


byte *statdata; /* Allows Status Register data to be passed back to the */ 
/* main program for further analysis */ 
{ 
byte far *stataddr; /* Pointer variable used to write commands to device */ 
stataddr = (byte far *)SYSADDR; 
*stataddr = STATREAD; /* Write Read Status Register command to 28F008SA a 
if (((*statdata = *stataddr) & RDYMASK) ‘'= WSMRDY) 
return (1); /* Byte write/block erasure still in progress...code "1" */ 
return (0) ; /* Byte write/block erase attempt completed...code "0" =/ 


Routine end( ) detects completion of byte write or block erase operations of a 28FOO8SA. It passes back the Status 
Register data it reads from the device. It also returns “0” if Status Register bit 7 indicates WSM “Ready”, and “1” if 
indication is that the WSM is still “Busy”. 
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/* Function: Eraschk */ 
/* Description: Completes full Status Register check for block erase (proper command */ 
/* sequence, Vpp low detect, block erase success). This routine assumes that block */ 
f* erase completion has already been checked in function end(), and therefore does */ 
/* not check the WSM Status bit of the Status Register al J 
J? Inputs: Statdata: Status Register data read in function end */ 
/* Outputs: None */ 
{* Returns: 0 = Block erase completed successfully dl 4 
f? 1 = Error; Vpp low detect “y 
|i 2 = Error; Block erase error */ 
,* 3 = Error; Improper command sequencing if J 
7 Device Read Mode on Return: Same as when entered “/ 
LPFETEAEAAG ESTES SSASERS LST SCS ORAS HS FECRASSSS SAE ELLE SASSECE SKS SOSVESSIASSAAKS SLACKS SLSSL ELSA LASS ASESS & / 
#define ESEQMASK 0X30 /* Mask to isolate the erase and byte write status bits of */ 
/* the Status Register */ 
#define ESEQFAIL 0X30 /* Status Register value after masking if block erase */ 
7* command sequence error has been detected se 
#define EERRMSK 0X20 /* Mask to isolate the erase status bit of the */ 
/* Status Register */ 
#define ERASERR 0X20 /* Status Register value after masking if block erase error */ 
/* has been detected a 3 
#define VLOWMASK 0X08 /* Mask to isolate the Vpp status bit of the Status Register */ 
#define VPPLOW 0X08 /* Status Register value after masking if Vpp low *, 
/* has been detected */ 
int eraschk(statdata) 
byte statdata; /* Status Register data that has been already read from the */ 
/* 28F008SA in function end() at a 
{ 
if ((statdata & VLOWMASK) == VPPLOW) 
return (1); /* Vpp low detect error, return code "1" a 
if ((sStatdata & EERRMSK) == ERASERR) 
return (2); /* Block erase error detect, return code "2" a i 
if ((statdata & ESEQMASK) == ESEQFAIL) 
return (3) ; /* Block erase command sequence error, return code "3" */ 
return (0); /* Block erase success, return code "0" */ 


Routine eraschk( ) takes the Status Register data read in end( ) and further analyzes it. It returns “0” if block erase 
was successful, “1” if Vpp low error was detected, “2” if block erase error was reported and “3” if an erase command 
sequence error was found (erase setup followed by a command other than erase confirm). This is useful after a block 


intel. 
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or string of blocks has been erased, to check for successful completion. 
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/* Function: Writebgn */ 
/* Description: Begins byte write sequence : */ 
/* Inputs: wdata: Data to be written into the device */ 
/* waddr: Target address to be written of i 
/* Outputs: None al 
/* Returns: 0O = Byte write successfully initiated */ 
/* 1 = Byte write not initiated (ID check error) */ 
/* Device Read Mode on Return: Status Register (ID if returns 1) ad 


PEPPSERESESSRESESLOSKAAVEHLELSRCSLA SSSR EFERAKSESSS LS SSSESSOSOAREASS ELSES SELLE ERS ESTES SELES SASS SEL ECS SSAA SE / 


#define SETUPCMD 0X40 /* Byte Write Setup command */ 


int writebgn(wdata,waddr) 


byte wdata; /* Data to be written into the 28F008SA */ 
byte far *waddr; /* waddr is the destination address for the data */ 
/* to be written */ 


byte mfgrid,deviceid; 


if (idread(&mfgrid,&deviceid)==1) /* Device ID read error...powered up? */ 
return (1); 

*waddr = SETUPCMD; /* Write Byte Write Setup command and destination address */ 

*waddr = wdata; /* Write byte write data and destination address */ 


return (0); 


} 


SPSSSESESSTARSSSSLESTHE SESS SSS SSE TES SLSL ESA RSL KS SSEES SASS LES SASEAS ESAS CEOS ER ESE RESP ESSE SAS LES CASS HSS ES f 


Fie Function: Writechk */ 
/* Description: Completes full Status Register check for byte write (Vpp low detect, byte */ 
/* write success). This routine assumes that byte write completion has already */ 
/* been checked in function end() and therefore does not check the WSM Status *] 
/* bit of the Status Register */ 
/* Inputs: Statdata: Status Register data read in function end() * 
/* Outputs: None */ 
/* Returns: O = Byte write completed successfully */ 
j/* 1 = Error; Vpp low detect er 
/* 2 = Error; Byte write error */ 
/* Device Read Mode on Return: Status Register “ys 


JEBPOSEESSS TES SSSSSERS SLES SSE SSE SES SESH SSES ESSER TERETE SEE SSS EOLSSELESESS SHKT SECS SESS LS SESOSSHSSELEMESCLRS SS f 


#define WERRMSK OX10 /* Mask to isolate the byte write error bit of the */ 
/* Status Register */ 
#define WRITERR 0X10 /* Status Register value after masking if byte write error */ 
| iia has been detected */ 
#define VLOWMASK » 0X08 /* Mask to isolate the Vpp status bit of the */ 
s* Status Register */ 
#define VPPLOW 0X08 /* Status Register value after masking if Vpp low all 
/* has been detected */ 


int writechk(statdata) 


byte statdata; /* Status Register data that has been already read from the */ 
/* 28F008SA in function end() */ 
{ 
if ((Statdata & VLOWMASK) == VPPLOW) 
return (1); /* Vpp low detect error, return code "1" */ 
if ((statdata & WERRMSK) == WRITERR) 
return (2) ; /* Byte write error detect, return code "2" */ 
return (0) ; /* Byte/string write success, return code "0" */ 


Routine writebgn( ) issues a byte write command sequence to a 28FOO8SA. It is passed the desired system address for 
the byte to be written, as well as the data to be written there. After calling idread( ), it writes the byte write command 
sequence at the specified address. It returns “0” if byte write initiation was successful, and “1” if the ID read fails 
(device not powered up or RP# not disabled). 

Routine writechk( ) takes the Status Register data read in end( ) and further analyzes it. It returns ‘‘0” if byte write 
was successful, “1” if Vpp low error was detected, and “2” if byte write error was reported. This is useful after a byte 
or string of bytes has been written, to check for successful completion. 
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/* Function: Idread */ 
* fag Description: Reads the manufacturer and device IDs from the target 28FO08SA */ 
/* Inputs: None */] 
/* Outputs: mfgrid: Returned manufacturer ID */ 
deviceid: Returned device ID *; 
/* Returns: O = ID read correct */ 
/* l = Wrong or no ID 7 
/* Device Read Mode on Return: Intelligent Identifier */ 
SPTEPERECSECEECLES ESS SELESESSAESSEESSSESSSSLSE SLSR SEEK ESESSER ASSESSES SERELREAE EES ESE SESS SESSETSE SSS SETSEE SESS D / 
#define MFGRADDR 0 /* Address "0" for the target 28FO08SA...alterable depending */ 

J* on the system architecture */ 
#define DEVICADD 1 /* Address "1" for the target 28FOO8SA...alterable depending */ 

/* on the system architecture 7 
#define IDRDCOMM 0X90 /* Inteligent Identifier command */ 
#define INTELID 0X89 /* Manufacturer ID for Intel devices */ 
#define DVCID OXOA2 /* Device IDs for 28FO08SA */ 


#define DVCID2 OXOA1 


int idread(mfgrid,deviceid) 


byte *mfgrid; /* The manufacturer ID read by this function, to be */ 
/* transferred back to the calling program 7 
byte *deviceid; /* The device ID read by this function, to be transferred */ 
/* back to the calling function “J 
{ 
byte far *tempaddr; /* Pointer address variable used to read IDs */ 
tempaddr = (byte far *)MFGRADDR; 
*tempaddr = IDRDCOMM; /* Write Intelligent Identifier command to an address within */ 
/* the 28F008SA memory map (in this case 00 hex) */ 
*nfgrid = *tempaddr; /* Read mfgr ID, tempaddr still points at address "0" */ 
tempaddr = (byte far *)DEVICADD; /* Point to address "1" for the device specific ID a 
*deviceid = *tempaddr; /* Read device ID */ 
if ((*mfgrid != INTELID) || ((*deviceid != DVCID) && (*deviceid != DVCID2))) 
return (1); /* ID read error; device powered up? */ 


return (0); 


Routine idread( ) issues the Intelligent Identifier command to a 28FOO8SA. It passes back the manufacturer and 
device IDs it reads. In addition, it returns ‘0’ if the IDs read matched those expected for the 28FOO8SA or 
28FO08SA-L, and “1” if either the manufacturer or device IDs did not match. 
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/* Function: Statrd */ 
/* Description: Returns contents of the target 28FOO8SA Status Register */ 
/* Inputs: None ry 
;* Outputs: statdata: Returned Status Register data ‘6! 
;* Returns: Nothing ad 
f* Device Read Mode on Return: Status Register uf’ J 
JPSSESESSSL ELSES SESS SSSS ESE SLES ESSE SLSRSALERES SERVES SASSLSSRSESS SSSA SS SESASSSSTESES SRS SESESESS SSL OVSL SSS 7 
#define STATREAD 0X70 /* Read Status Register command */ 
#define SYSADDR 0 /* This constant can be initialized to any address within */ 

/* the memory map of the target 28F008SA and is */ 

/* alterable depending on the system architecture */ 


int statrd(statdata) 


byte *statdata; /* Allows Status Register data to be passed back to the a 
/* calling program for further analysis */ 
{ 
byte far *stataddr; /* Pointer variable used to write commands to device */ 
stataddr (byte far *)SYSADDR; 


*stataddr = STATREAD; /* Write Read Status Register command to 28F008SA */ 
*statdata = *stataddr; 
return; 


[RRREREEREEARR AREER RAE ERARERER ARERR EEERREEREREEEEEEE A EREERE EERE RARE RAREEERREEREARREERREREREE DEERE HY 


/* Function: Statclr +f 
/* Description: Clears the 28FO08SA Status Register */ 
/* Inputs: None */ 
/* Outputs: None */ 
/* Returns: Nothing *) 
/* Device Read Mode on Return: Array */ 


fTPtTSECESESS SST ELET FEST ESSE SSS ESESE SSPE SS ESES SESS ESS SES SSS SESSS SESSA SSCA LSSLESSS SERS ESA ESERESE SELES AS SSS 


#define STATCLER 0X50 /* Clear Status Register command */ 
#define SYSADDR 0 /* This constant can be initialized to any address within */ 
F tha the memory map of the target 28F008SA and is */ 
j* alterable depending on the system architecture */ 


int statclr() 


{ 


byte far *stataddr; /* Pointer variable used to write commands to device */ 
Stataddr = (byte far *)SYSADDR; 

*stataddr = STATCLER; /* Write Clear Status Register command to 28FO08SA */ 
return; 


Routine statrd( ) reads a 28FOO8SA Status Register. It issues the Read Status Register command and passes back the 
data it obtains. 


Routine statclr( ) issues the Clear Status Register command to a 28FOO8SA. This routine is required after analyzing 


Status Register contents in routines like eraschk( ) and writechk( ). The 28FOO8SA Status Register retains state of 
bits 3—6 until they are cleared by the Clear Status Register command. 
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/* Function: Rdmode ‘ */ 
7, Description: Puts the target 28FO08SA in Read Array Mode. This function might be used, for */ 
/* example, to prepare the system for return to code execution out of the Flash * / 
Y shed memory after byte write or block erase algorithms have been executed off-chip */ 
/* Inputs: None *J 
/* Outputs: None */ 
/* Returns: Nothing * 
/* Device Read Mode on Return: Array */ 


JFFPSSSHSSSLAPSHPE SOLAS HLERSRE TSH SHAS AHHERSERE SAS SE LAS ALEREL EDS ES HESS SST SSER ESSE SPSS RES SES ESS PEAS S IIA S S/S 


#define RDARRAY OXFF /* Read Array command */ 
#define SYSADDR 0 /* This constant can be initialized to any address within */ 
/* the memory map of the target 28F008SA and is */ 


j* alterable depending on the system architecture 77 
int rdmode() 


byte far *tempaddr; /* Pointer variable used to write commands to the device */ 


tempaddr = (byte far *)SYSADDR; 
*tempaddr = RDARRAY; /* Write Read Array command to 28F008SA */ 
return; 


} 


PEST SECETE RSE SES SESS SSS LESS SES SESS SESS SESS SSR SSS SES SEES COTS TS PRS E OTE TR Pee TP ee ee ESS SS ESET TCHS CS Ff 


/* Function: Rdbyte */ 
/* Description: Reads a byte of data from a specified address and returns it to the */ 
/* calling program "7 
/* Inputs: raddr: Target address to be read from */ 
/* Outputs: rdata: Data at the specified address y */ 
/* Returns: Nothing */ 
/* Device Read Mode on Return: Array *] 


PPPESSSESESESSESSEESSSL ES SPA SSAS SRE SL AELESESS A HSER OCT SES SSPE SSS ELSE VES ESSE COSTS SSS ESS ESSE LOSSES CESS SSS SS SF / 


#define RDARRAY OXFF /* Read array command af 
/ 
int rdbyte(rdata,raddr) 
byte *rdata; /* Returns data read from the device at specified address */ 
byte far *raddr; /* Raddr is the target address to be read from */ 
{ 
*raddr = RDARRAY ; /* Write read array command to an address within the */ 
/* 28F008SA (in this case the target address) */ 
*rdata = *raddr; /* Read from the specified address and store */ 
return; 


Routine rdmode( ) simply puts a 28FOO8SA in Read Array mode. This is useful after byte write and block erase 
operations, to return the 28FOO8SA to its “normal” mode of operation. After block erase or byte write, the 
28F008SA will continue to output Status Register data until the Read Array command is issued to it, for example. 


Routine rdbyte( ) not only puts the 28FOO8SA in Read Array mode, it also reads a byte of data. It is passed the 
desired system byte address, and passes back the data at that address. 
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/* Function: Vppup “7 
/* Description: Ramps the Vpp supply to the target 28F008SA to enable byte write or block */ 
/* erase. This routine can be tailored to the individual system architecture. For */ 
* purposes of this example, I assumed that a system Control Register existed at my 
jf? System address 20000 hex, with the following definitions: */ 
i i 
/* Bit 7: Vpph Control: 1 = Enabled *f 
f* 0 = Disabled * / 
/* Bit 6: PWD Control: 1 = PowerDown Enabled */ 
/* 0 = PowerDown Disabled */ 
/* Bits 5-0: Undefined */ 
i | , HA 
f* Inputs: None */ 
;* Outputs: None */ 
a Returns: Nothing */ 
f* Device Read Mode on Return: As existed before entering the function. Part is now ready for */ 
i program or erase “/ 


SEPP ESAS ESSERE ES CSET CESSES SHEE ASSES OSS SSE SEES E LE SESE ELS ELSE SSVS SGD FEEEOES HESS ESET EFSTSESS FFSESHELOES © J 


#define VPPHIGH 0X80 /* Bit 7 = 1, Vpp elevated to Vpph */ 
#define SYSCADDR 0OX20000 /* Assumed system Control Register Address */ 


int vppup() 
{ 


byte far *contaddr; /* Pointer variable used to write data to the system */ 
y* Control Register */ 

contaddr = (byte far *)SYSCADDR; 

*contaddr = *contaddr | VPPHIGH; /* Read current Control Register data, "OR" with */ 
| a constant to ramp Vpp sal 

return; 


} 


[PERSE EESESES EER ERE L ESR ELS SHES EELS ELSES TEESE RSS LELS SSE ESR SSSA LES LAG ERSELES LESS SEERSE SCARE ASSESSES £ 


/* Function: Vppdown +s 
/* Description: Ramps down the Vpp supply to the target 28FO08SA to disable byte write/block */ 
/* erase. See above for a description of the assumed system Control Register. a 
J? Inputs: None i 
/* Outputs: None */ 
/* Returns: Nothing df 
/* Device Read Mode on Return: As existed before entering the function. Part now has high Vpp */ 
/* disabled. If byte write or block erase was in progress when this function was */ 
/* called, it will complete unsuccessfully with Vpp low error in the * 
J* Status Register. */ 
JPPTSS SAE ES SALES SESS SEE EE ST FLFR ESSE ERS CSE CESS CESS ESE ESS SSDS SSE SS ESET EES ES SSS LST ESES ELE TERE RESTS SECTS F 7 
#define VPPDWN OX7F /* Bit 7 = 0, Vpp lowered to Vppl */ 
#define SYSCADDR 0X20000 /* Assumed system Control Register Address */ 


int vppdown() 


byte far *contaddr; /* Pointer variable used to write data to the system */ 
7 Control Register */ 

contaddr = (byte far *)SYSCADDR; 

*contaddr = *contaddr & VPPDWN; /* Read current Control Register data, "AND" with */ 

/* constant to lower Vpp */ 

return; 


Functions vppup() and vppdown() give examples of how to control via software the hardware that enables or 
disables 12V Vpp to a 28FOO8SA. The actual hardware implementation chosen will drive any modification of these 
routines. 
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/* Function: Pwden */ 
/* Description: Toggles the 28FO08SA RP# pin low to put the device in Deep PowerDown mode. * 7 
/* See above for a description of the assumed system Control Register. ot i 
) Inputs: None */ 
/* Outputs: None */ 
/* Returns: Nothing a 
/* Device Read Mode on Return: The part is powered down. If byte write or block erase was in */ 
/* progress when this function was called, it will abort with resulting partially */ 
/* written or erased data. Recovery in the form of repeat of byte write or block * J 
deg erase will be required once the part transitions out of powerdown, to “; 
f* initialize data to a known state. "/ 
LPSFPOAES CHEK SSESRESL SSA SAS? ESSSEKSTSERT ESSA SSAA ER SHEA SEKE SESS SRE EEE SLE LS FHRE SEES SES ESESERAAGES LESS SELL DS / 
#define PWD 0X40 /* Bit 6 = 1, RP# enabled */ 
#define SYSCADDR 0OX20000 /* Assumed system Control Register Address */ 


int pwden() 
{ 


byte far *contaddr; /* Pointer variable used to write data to the system 

f* Control Register */ 
contaddr = (byte far *)SYSCADDR; 
*contaddr = *contaddr | PWD; /* Read current Control Register data, "OR" with constant */ 


ins to enable Deep PowerDown eF 
return; \ 


fESOOT ESR SSDS OFFS EST SSSR EASESSR CESS SESS ESOS SSS CEST ESS SASS CASE SLE ELE ES CORE TEER ESET SESS ESET ORES ES © 


ee Function: Pwddis */ 
/* Description: Toggles the 28FO08SA RP# pin high to transition the part out of Deep */ 
/* PowerDown. Seé above for a description of the assumed system Control Register. */ 
/* Inputs: None */ 
/* Outputs: None * / 
/* Returns: Nothing */ 
y* Device Read Mode on Return: Read Array mode. Low voltage is removed from the RP# pin. */ 
f* 28FO08SA output pins will output valid data time tPHQV after the RP# pin */ 
/* transitions high (reference the datasheet AC Read Characteristics) assuming */ 
/* valid states on all other control and power supply pins. */ 


JEPETESELL FERALAS REOR ELS TESS HESS SHE LARS ES ESESERALES SE SSRELA SESS SELESA FELL ALES ECTS VOR ECE ORE EAR EES S LETS O 


#define PWDOFF OXBF /* Bit 6 = 0, RP# disabled */ 
#define SYSCADDR 0OX20000 /* Assumed system Control Register Address */ 


int pwddis() 


{ 


byte far *contaddr; /* Pointer variable used to write data to the system */ 
/* Control Register */ 
contaddr = (byte far *)SYSCADDR; 
*contaddr = *contaddr & PWDOFF; /* Read current Control Register data, "AND" with */ 
/* constant to disable Deep PowerDown */ 
return; 


Functions pwden( ) and pwddis( ) give examples of how to control via software the hardware that enables or disables 
a 28FOO8SA RP# input. The actual hardware implementation chosen will drive any modification of these routines. 
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ADDITIONAL INFORMATION 


Order Number 
28F008SA Datasheet 290429 
28F008SA-L Datasheet 290435 
AP-359 ‘“28FO08SA Hardware Interfacing” 292094 
AP-364 ‘28FO08SA Automation and Algorithms” 292099 
ER-27 “The Intel 28FOO8SA Flash Memory”’ 294011 
ER-28 “ETOX-III Flash Memory Technology” 294012 


REVISION HISTORY 


| Number Description 
ia See Revised Erase Suspend Algorithm in “C”’ Drivers. 


PWD # pin renamed RP # to match JEDEC standards. 
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intel. 
1.0 INTRODUCTION 


As personal computers migrate to platforms that are 
easily held with one hand, a revolutionary system archi- 
tecture is required to meet space and power require- 
ments. 


e An architecture that is not bounded by what has 
been done before with existing memory architecture, 
but free to meet the demanding requirements of mo- 
bile end users. 


e An architecture free to adapt and accommodate new 
technological advances in software and hardware, 
while protecting end-users initial base hardware in- 
vestment. 


Implementing this new system architecture requires 
traditional PC storage media such as ROM, DRAM, 
floppy disk and hard disk to move aside and make 
room for the latest in memory storage, Intel’s 
FlashFileTM memory (see architecture comparison in 
Figure 1.). 


Data Code File & Code 
H ©Application Manipulation Execution Storage 


DRAM/ROM | FDD/HDD 


Desktops 


FLASH 


Portables - Resident Disk 


- Flash Card 
- Flash Drive 
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Figure 1. Architecture Comparison 


By combining FlashFile memory with new system ar- 
chitecture, completely new types of computers are now 
possible that fit in the palm of your hand and replace or 
integrate many of the code or storage functions of other 
memory types. Moreover, FlashFile memory enables 
hand-held computers to last many hours on just a cou- 
ple of AA batteries. FlashFile memory can be used for 
storing eXecute- In-Place (XIP) code in the system’s 
memory map, while additionally functioning like a disk 
for file and program storage. Since this type of design 
features FlashFile memory resident on the PC’s moth- 
erboard and is typically arranged in an array, it is de- 
scribed as a Resident Flash Array (or RFA). To further 
differentiate the two tasks of an RFA, the file store task 
is called a Resident Flash Disk (RFD), while the XIP 
task is called Resident Flash for XIP (or RFX) code 
storage. 
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The FlashFile memory is also used in card form as 
specified by the Personal Computer Memory Card In- 
ternational Association (PCMCIA). Flash memory 
cards provide file and program storage similar to an 
RFD, but add the feature of removability, increasing or 
adding to ease-of-use for the end user. The PCMCIA 
specification addresses both the memory and I/O 
card’s physical, electrical and mechanical characteris- 
tics, while leaving the host PC implementation relative- 
ly free for interpretation. Enhancing the PCMCIA 
specification, Intel developed the Exchangeable Card 
Architecture (ExCAT™), which defines the host PC 
system card interface. ExCA further refines the 
PCMCIA specification and provides for card exchange- 
ability and inter-operability for both memory and I/O 
cards. 


Memory and I/O cards complement this new mobile 
architecture by integrating many of the common but 
functionally separate tasks used by today’s mobile pro- 
fessional in either electronic or paper form. Some of 
these tasks are schedule keepers, phones, address 
books, checkbooks, credit cards, fax, pagers, personal 
voice storage, task managers/schedulers, paperless 
form reports, scratch pads, and notepads. 


1.1 Why A New Memory 
Architecture? 


The ideal hand held memory system is: 


© Power Conscious (prolongs battery life and reduces 
heat) 


© Dense (stores lots of code and data in a small 
amount of space but weighs very little) 


© Updateable (allows in-situ code enhancements) 
© Fast (lets you read and write data quickly) 
¢ Inexpensive (low cost per megabyte) 


® Reliable (retains data when exposed to extreme tem- 
perature and mechanical shock) 


Since the PC’s introduction over 10 years ago, design- 
ers have grappled with how to construct memory sys- 
tems that met the above criteria. Portable computing 
makes the system design even tougher with more strin- 
gent requirements for low power, low volume and less 
weight. The best combination available for portable de- 
signs in their infancy was the same as used for the desk- 
top; solid-state memory and magnetic storage, i.e., 
SRAMs, DRAMS plus magnetic hard disks. DRAMs 
are dense and inexpensive, yet slower than the proces- 
sors they serve, and they are volatile. SRAMs, although 
fast enough to keep pace with processors, are relegated 
to caching schemes (compensating for DRAM’s slow- 
ness) due to low density and high cost while also being 
volatile. Magnetic hard disks, the nonvolatile append- 
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age to DRAM and SRAM, are dense, inexpensive on a 
cost-per-megabyte basis and nonvolatile, but are slow, 
power hungry, take up a sizable amount of volume and 
are susceptible to damage from physical shock. 


Mobile computing designs cannot depend on hard 
drives as portable notebook PCs do. Volume (4” x 8 x 
0.5” or less), power (two AAs), and shock constraints 
preclude using even the 1.3” hard drives available 
today. Also, vitally important data such as credit card 
numbers or transactions, signatures, or checkbook 
information demands reliability of the highest order. 


1.2 The Flash Memory Alternative 


High Density 


Intel’s ETOX III Flash Memory Cell is 30% smaller 
than equivalent DRAM cells; therefore it will closely 
track DRAM density. Intel’s 28FOO8SA FlashFile 
Memory can store 8 megabits, or one megabyte, of 
data. Flash memory is more scaleable than DRAM be- 
cause the flash storage cell is not sensitive to soft error 
failure, therefore it can have a more simple cell struc- 
ture. Thus as density increases and process lithography 
continues to shrink, flash memory will pace and ulti- 
mately overtake the DRAM technology treadmill. 


Updatable 


ROMs and EPROMs may offer lower device costs, but 
if servicing the customer or end-user is important to an 
OEM, overall system cost must be factored in. Al- 
though ROMs and EPROMSs are nonvolatile, changing 
the code within them is either very difficult (in the case 
of EPROMs) or entirely impossible (in the case of 
ROMs). Whole inventories of ROMs could be lost in 
the event of a catastrophic bug, while an innovative 
design with FlashFile memory can be updated in the 
factory or by end-users via networks, OEM Bulletin 
Board Systems, or other memory cards. Updating sys- 
tems could actually become a second source of income 
for OEMs and Independent Software Vendors, enhanc- 
ing the quality of the product while increasing end-user 
satisfaction. 


Power Conscious 


Intel’s FlashFile memory provides a deep powerdown 
‘mode, reducing power consumption to typically less 
than 0.2 A. Typical read current is only 20 mA while 
typical standby current (flash memory not being ac- 
cessed with CE# high) is only 30 wA. Additionally, 
FlashFile devices operating at 3.3 Vcc are available for 
state-of-the-art low power consumption designs. 
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Fast 


Don’t be misled by technology-to-technology speed 
comparisons. Architecting a system around FlashFile 
memory bypasses the code/data bottleneck created by 
connecting slow mechanical serial memory (such as 
disks) to a high-performance, parallel-bussed processor 
system. For example, data seek time for a 1.8” magnet- 
ic hard disk is 20 ms, plus an 8 ms average rotational 
delay, while flash memory access time is less than 
0.1 ms. At the chip level, read speeds for FlashFile 
memory are about 85 ns. Therefore, either direct execu- 
tion of code from flash memory or downloading to sys- 
tem RAM will dramatically enhance overall system 
performance. 


Nonvolatile 


Unlike DRAM or SRAM, FlashFile memory requires 
no battery backup. Further, Intel’s flash devices retain 
data typically for over 100 years, well beyond the useful 
lifetime of even the most advanced computer. 


Rugged and Reliable 


On average, today’s hard-disk drives can withstand up 
to 10 Gs of operating shock; Intel’s FlashFile memory 
can withstand as much as 1000 Gs. FlashFile compo- 
nents can operate beyond 70°C while magnetic drives 
are limited to 55°C. Intel’s FlashFile Memory can be 
cycled 100,000 times per block or segment. Even be- 
yond that cycle level, FlashFile does not fail or lock up 
like EEPROM devices, it just tends to take longer to 
erase blocks and program bytes than the times specified 
in the data sheet. By employing wear-leveling tech- 
niques, a 10 KB file written every 5 minutes, 24 hours a 
day to a 20 MB flash array takes 1.2 million hours or 
136 years before reaching the 10,000 cycle level. 


Many applications benefit from ROMed or XIP ver- 
sions of code, particularly hand held personal comput- 
ers, vertical application pen-based clipboards, and in- 
dustrial control and data accumulation equipment. 
These applications pose system design constraints re- 
quiring small form factor, low power consumption, and 
ruggedized construction due to active mobile users or 
harsh environments. Exposure to shock, vibration, or 
temperature extremes is common, precluding the use of 
rotating media. Flash memory provides an excellent 
code storage choice for such system designs featuring 
thin TSOP packaging, low (deep powerdown mode) or 
zero (capability to shut off power without losing data) 
power consumption, and 1000 G shock resistance and 
extended temperature products. Additionally flash 
memory provides remote or end-user update capability 
over ROMs, allowing OEM’s to service their products 
more efficiently and add new software features and ap- 
plications after the sale. 
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The features of Intel’s FlashFile memory truly enables 
new, compact and portable system architecture. This 
application note discusses implementing just such a de- 
sign using Intel’s boot block flash memory and Intel’s 
FlashFile (28FOO8SA) components for extended memo- 
ry eXecute-In-Place (XIP) code store, disk-like func- 


tionality for file and program storage, and BIOS code 
storage. 


Related Publications 


The following data books and reference manuals pro- 
vide valuable information for developing an RFA- 
based design: 


® Intel 28FOO8SA Data Sheet Order number 290429 


® Microsoft MS-DOS 5.00 ROM Technical Specifica- 
tion and OEM Adaptation Kit (OAK) 


® Microsoft Flash Filing System OAK 


@ Microsoft Windows 3.1 ROM Technical Specifica- 
tion and OAK : 


For additional information on flash memory, power 
supply solutions and EPLDs, see Appendix A. 


2.0 SOFTWARE DESIGN 


Software design is considered first for solid-state de- 
signs because the software functionality desired affects 
in large part how the hardware design is implemented. 
Many software products exist for solid-state systems: 


¢ DOS operating systems from Microsoft, Novell’s 
Palm DOS and Datalight’s ROM-DOS 

e A Graphical User Interface (GUI) operating system 
in Windows 3.1 ROM version 

e Application software from Microsoft (such as 
Word, Excel and MS-Works) and Lotus 1-2-3 Ver- 
sion 2.2. 


Because no standardization exists, implementation dif- . 


fers from package to package or vendor to vendor. 
Therefore, this application note describes a system us- 
ing MS DOS ROM Version, MS Flash Filing System, 
~ Windows 3.1 ROM Version plus Pen extensions. All 
are readily available applications today and offer the 
highest inter-compatibility. However, the hardware and 
software design concepts presented here work just as 
well with Novell’s (formally DRI) Palm DOS and also 
GO Corporation’s Penpoint operating systems. 


2.1 XIP Operating System 


The first decision one must make for a solid-state soft- 
ware design is the operating system. Many alternatives 
exist for small hand held computer systems. Any solu- 
tion depends on what requirements are placed on desk- 
top compatibility, software compatibility, and ease of 
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developing applications. In the pen-based market, DOS 
compatibility is not necessarily a requirement. This is 
evident by the multiple emerging entries of pen-based 
GUID’s. However, data transfer using a medium such as 
memory cards between desktop systems and hand held 
computers depends on an agreed file format. At least 
for now, DOS is still the major operating system of 
choice for the largest number of desktop systems. 
Therefore, DOS compatibility is still a necessity for 
many hand held computing systems and is incorporated 
in this design. 


To insure compatibility and easy system integration, 
MS DOS 5.0 ROM Version is the easiest choice. With 
this version, an XIP DOS implementation can be con- 
figured to as small as 64 KB using just the Runtime 
Kernel and a minimized command interpreter. If 
CONFIG.SYS and AUTOEXEC.BAT processing is re- 
quired, an additional 56 KB are required plus a ROM 
DISK large enough to hold AUTOEXEC.BAT, 
CONFIG.SYS, and any drivers and files that are refer- 
enced by either file. 


Microsoft provided the capability for additional XIP 
DOS applications to be added to an MS DOS XIP im- 
plementation by providing two new DOS functions, 
“Find First ROM Program” and “Find Next ROM 
Program.” This allows DOS-based XIP applications 
(such as OEM-specific utilities and applications or Em- 
bedded DOS applications) to easily be added to the MS 
DOS 5 ROM build. 


Many different memory configurations MS-DOS ROM 
are possible by distributing various software pieces (Mi- 
crosoft refers to them as granules) between different 
ROM locations below and above the 1 MB address 
space. Certain restrictions exist on individual granules 
requiring them to appear below 1 MB. The granules 
and address location requirements are specified in a ta- 
ble within the MS DOS ROM 5.0 OAK. Approximate- 
ly 43 KB of granules must be located below the first 
1 MB of address space. Other granules can be located 
either below or above 1 MB. The total size of all gran- 
ules in this design is approximately 128 KB. 


How MS DOS ROM Boots Up 


For system startup and booting DOS without a disk, 
MS DOS 5 ROM must intercept the INT 19h call made 
by the BIOS. This is accomplished by locating a gran- 
ule as an adapter ROM within adapter space (CO000h- 
EFFFFh). This granule contains the ROM scan identi- 
fier “SSAAh” which must appear on a 2 KB boundary 
and identifies the module as a ROM to the BIOS dur- 
ing Power On Self-Test (POST), and also identifies the 
MS DOS 5 ROM INT 19h interceptor. When the BIOS 
Post code identifies the ROM, control is turned over to 
the ROM for its initialization. At this time, the MS 
DOS 5 ROM redirects the INT 19h vector to the MS 
DOS 5 ROM code and control returns back to the 
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BIOS POST code. When the BIOS is completely fin- 
ished testing and initializing, it issues INT 19h, and the 
MS DOS 5 ROM INT 19h handler gains control. The 
handler loads the MS DOS 5 ROM bootstrap loader 
into RAM and passes control to it. If the bootstrap 
loader includes the ““Multi-Boot”’ option, a list of menu 
boot options are presented to the user if an OEM de- 
fined key is being pressed. The menu might look like 
Figure 2. 


Booting from a disk: 
1 Boot from Floppy Disk. 
2. Boot from Hard Disk 


Booting from ROM: 


Floppy is default; process startup files. 

Hard drive is default; process startup files. 
Floppy is default; do not process startup files. 
Hard drive is default; do not process startup files. 
ROM drive is default; process startup files. 


Figure 2. Multi-Boot Menu 


The menu is activated by pressing the ALT key during 
the system memory scan, which is the default provided 
in the OAK. Other types of keys may be selected by the 
OEM for their specific implementation. Selecting the 
options under Booting from a disk will bypass the 
ROM system completely. Selecting the options under 
Booting from ROM will invoke MS DOS 5 ROM and 
whatever the option specifies for processing the startup 
files, CONFIG.SYS and AUTOEXEC.BAT. 


If the Multi-Boot option is not available or is not acti- 
vated by the user, the MS DOS 5 ROM bootstrap load- 
er reads a byte from CMOS RAM to determine boot 
options. The byte is defined in Figure 3. 


Default Default ROM Default 
Reserved Drive If Drive If CONFIG.SYS Boot 
ROM Boot | ROM Boot Processing 


Default Boot Bit 0: 
0- Boot from ROM 
1- Normal disk boot operation (first is drive 00, then drive 80) 


ROM Configuration Processing Bit 1: 
0- Process CONFIG.SYS and AUTOEXEC.BAT from default drive 
1- Do NOT process CONFIG.SYS or AUTOEXEC.BAT files 


Default Drive if ROM Boot Bits 2 & 3: 
00- First Floppy Drive (Oh) 

01- First Hard Drive (80h) 

10- ROM Drive 


Figure 3. CMOS Byte Definitions 
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If the system is to boot from ROM by either selecting 
the Multi-Boot option or reading the CMOS byte, the 
MS DOS 5 ROM bootstrap loader loads BIOS (note: 
not system BIOS, but the BIOS layer of MS DOS) and 
DOS initialization granules into RAM, records the ad- 
dresses of the resident BIOS and DOS code granules in 
the BIOS data area, records boot options (default drive, 
CONFIG.SYS & AUTOEXEC.BAT processing) in the 
BIOS data area, and passes control to BIOS initializa- 
tion. Just before the end of BIOS initialization, control 
is passed to SYSINIT which moves itself and DOS data 
and initialization code to high memory where both 
SYSINIT and DOS initialization takes place. Next 
SYSINIT then reads and processes the CONFIG.SYS 
file where installed drivers called in CONFIG.SYS and 
additional elements of the DPB chain will be placed in 
memory following the existing DOS structures as well 
as system buffers allocated. At this point, system boot- 
strap is finished and the command interpreter is started 
using the DOS call to execute ROM utilities. If a full 
command processor is chosen, the user will now see 
“C:>” prompt. 


2.2 DOS In Flash Implementation 


For this particular implementation, a full version of MS 
DOS with the full Command processor was chosen. 
This configuration uses 64 KB of adapter space (upper 
memory) at E0000h to EFFFFh for MS-DOS 5 ROM, 
and a combination 64 KB XIP binary file and a 256 KB 
ROM Disk binary file located in extended memory at 
F90000h. See Figure 4. ROM DOS and ROM Disk 
Memory Maps. This location is just after the end of the 
XIP GUI code block. The 64 KB XIP Binary contains 
the transient portion of COMMAND.COM and the 
DOS BIOS initialization and is created during the build 
of the MS DOS 5 ROM system, while the 256 KB 
ROM Drive contains the necessary files for bringing up 
the system and loading the MS Flash File System driv- 
ers which is addressed in the next section. 


ISA Address Map 


FFFFFh 
FOO00h Wp 
£0000h US Y/// 
CFFFFh 
CCo00h 
C7FFFh Hs 


Video BIOS 
C0000h 


BOOOOh 
A0000h 


640 KB User RAM 
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1-16 MB ISA Address Map 


FFFFFFH 


292097-3 


Figure 4. ROM DOS and ROM Disk Memory Maps 


The E0000h segment was chosen because it happens to 
be free on the flash BIOS storage chip. Also, later on in 
this design we will be adding an RFD, which uses up 
the whole DOOOOh segment, and ExCA which requires 
16 KB of adapter space that we located at CCO00h (see 
Figure 4 for a memory map). The ROM disk image 
location was chosen because there was room available 
in the extended XIP portion. The XIP portion is locat- 
ed at C00000h (12 MB) due to compatibility reasons 
with the 386SL processor and SL window constraints. 
In a non-SL design, the ROM disk portion of MS DOS 
ROM can be located anywhere in extended memory 
above 1 MB. 


A copy of the ROM image description file is included 
in Appendix B. The following summarizes the steps 


taken for building a ROM version of DOS is taken 
from the MS-DOS 5.00 ROM OAK. Please refer to the 
MS-DOS 5.00 ROM OAK for specific details. 


There are a set of compile options specified in the MS 
DOS 5 ROM OAK that need to be defined by the 
OEM for their particular implementation and are con- 
tained in the OAK file named “VERSION.INC’”’. The 
compile options used for this example are listed as fol- 
lows: 
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ROMDOS equ TRUE 
POWER equ FALSE 
ROMDRIVE equ TRUE 
CMOS equ TRUE 
CONFIGPROC equ TRUE 


For this application this means that for: 


“ROMDOS” —a ROMDOS build (as opposed 
to DISK build simulation) is 
used 

“POWER” — the MS DOS APM and power 
management are NOT used 

“ROMDRIVE” — the compiler will use the internal 
ROMDRIVE drivers 

“CMOS” — forces MS DOS 5 ROM to look 


at the CMOS byte if the Multi- 
Boot option is not chosen 


“CONFIGPROC” — normal CONFIG.SYS and 
AUTOEXEC.BAT processing 
will be used 


Since we are planning to use a ROM DRIVE, MS DOS 
5 ROM needs to know where the ROM DRIVE exists. 
To set the ROM drive base address, the MS DOS 5 
ROM OAK file ROMRDHI.ASM must be modified. 
Edit the file and set the ROMDRIVERBASE LO 
equal to 0000h and the ROMDRIVERBASE __ HI 
equal to OFAh, or 64 KB above the base address of the 
extended memory XIP module. 


Now the MS DOS ROM binaries are ready for build- 
ing. Using the MS NMK utility, 3 separate binary files 
are compiled based on the requirements and addresses 
specified in the MS-DOS ROM Image Description file 
in Appendix B. ROM binary files 1 and 2 can be com- 
bined into one 64 KB binary image as follows: 


copy /b ROM1.BIN + ROM2.BIN ROMDOS5.BIN 


Once the XIP binaries are built, the rest of the ROM 
disk needs to be built. First, specify a RAM Drive with- 
in your build or development PC using the MS DOS 
RAMDRIVE.SYS device driver as follows: 


device = RAMDRIVE.SYS 256 /e 


After rebooting your PC, copy the files needed for your 
particular application. For an example of CON- 
FIG.SYS and AUTOEXEC.BAT files, see Appendix 
C. Change the drive label as per the MS DOS 5 OAK 
instructions and then use the MS DOS IMGET utility 
to capture the image of the RAM drive into a binary 
file. Next, concatenate the ROM3.BIN binary image 
created by the NMK with the ROM Disk image cap- 
tured from the RAM drive by using the MS DOS copy 
command as stated earlier: 


copy /b ROM3.BIN + RDISK.BIN ROMDSK.BIN 
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This will create a 327 KB binary file with both XIP 
DOS code and the ROM Disk code for a single load 
into flash memory. 


Loading the ROMDOSS.BIN file into the system’s 
flash BIOS chip requires the use of a BIOS Independent 
Software Vendor’s (ISV) Flash Update Utility. Most 
major BIOS ISVs now offer such utilities. If your par- 
ticular system design uses a BIOS developed internally, 
refer to Intel’s AP-341 “Designing an Updatable BIOS 
Using FLASH Memory” (order number 292077) for 
more information on flash BIOS designs and related 
software. 


Loading the ROMDISK.BIN file requires developing a 
DOS-based utility to access flash memory in Protected 
Mode. Creating this utility is discussed under Section 
4.0, Software Utilities, subsection 4.2 Binary Loader. 


2.3 Resident Flash Disk 


Once a DOS-based, XIP operating system is in place, 
the next area to work on is file storage for flash memo- 
ry. File storage is possible with either FlashFile compo- 
nents or FlashFile cards, since they appear the same to 
file system software. However, the characteristics of 
flash memory are very unlike magnetic storage media 
characteristics. File Allocation Table (FAT)-based sys- 
tems rely on the fact that the operating system has un- 
restricted write capability and/or access to the media, 
particularly when updating the FAT for a file creation, 
update or deletion. Flash memory on the other hand, 
does not necessarily allow write access 100% of the 
time. When the flash memory media is completely 
erased (all FFh’s), writing data to the media can occur 
at any time and at any location. Additional data writes 
within the same block but at different locations can also 
occur. However, once a bit is written to a zero (Ob), | 
erasure of the whole block is required before allowing 
that particular bit to change back to one (1b). This 
asymmetrical characteristic of flash memory prevents 
using a straight implementation of the FAT-based file 
architecture and requires an alternative file system im- 
plementation to take advantage of Flash Memory bene- 
fits. 


Blocking 


Intel’s FlashFile memory offers 64 KB separately eras- 
able blocks enhancing the use of flash memory as a file 
storage medium. The large block size (as opposed to 
512 byte blocks or sectors) provides the system with 
fewer total blocks to manage, resulting in less system 
overhead used for file management. Additionally, large 
blocks reduce file fragmentation since large files will 
most likely be contained in one block as opposed to 
several 512 byte sectors. This reduced fragmentation 
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also improves read performance since files are more 
likely to be intact with a Flash File System vs. a FAT 


file system. These features led to the creation of Micro- 
soft’s Flash Filing System. 


2.3.1 MICROSOFT’S FLASH FILING SYSTEM 


To enhance the use of flash memory as a disk, Micro- 
soft created the Flash Filing System. This file system 
operates as a list of linked lists while keeping track of 
individual block erasure and file deletions, using mini- 
mal system overhead. File allocation structures use in- 
directly linked lists, allowing the file system to update 
files and data within the files without first requiring the 
area where the file is located to be erased and then 
updated. During file deletion, a file’s header structure is 
written to mark the file as deleted, removing the file 
from the file allocation listing. Once the array of flash 
memory contains a majority of deleted files, the file 
system performs a (background) cleanup operation and 
copies good files out to free blocks and erases the blocks 
with all the deleted files. This achieves the goal of the 
user being able to use flash memory the same as they 
would use any other mass storage media without doing 
anything different. 


Three distinct parts comprise the file system organiza- 
tion and implementation: 


— A File System Redirector, whose job is to intercept 
the disk operations passed to MS DOS by an appli- 
cation and translate them into generic file opera- 
tions, passing them on to the file system driver. 


— A File System Driver, which accepts generic file 
operations passed to it from the File System Redi- 
rector, implements the architecture and logic of the 
Microsoft Flash Filing System, and passes low-level 
commands such as read, write, copy, and erase to 
the device driver. | 


— A Device Driver, which accepts low-level com- 
mands from the File System Driver and interfaces 
to the host system hardware implementation. 


The File System Redirector performs a task analogous 
to a network redirector for LAN (Local Area Network) 
systems and appends itself to MS DOS. Any applica- 
tions then think they are running from a networked file. 
Some classes of applications and utilities will not oper- 
ate via this interface. Specifically, those applications 
that issue the INT 13h disk BIOS I/O call, INT 25h 
DosAbsRead, or INT 26h DosAbsWrite calls will not 
work properly with the Flash Filing system, just as they 
would not work over a network LAN. The File System 
Driver treats the flash media as a collection of large 
blocks, all identical in size. Individual block statistics 
are kept within a variable length structure at the top of 
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the block with the remainder of the space available for 
directory, file control structures and file data storage. 
The File System Driver also determines when de-allo- 
cated space (deleted files or directories) within a block 
is reclaimed for re-use. 


The device driver portion is OEM-modifiable and needs 
to be written for the specific hardware example used. 
This device driver, specifically called iCARD29, is cov- 
ered in more detail in the next section, ExCA Architec- 
ture, under iCARDDRYV File System Driver Summary. 
The only MS FlashFile System hardware requirement 
is a single window available per socket in a system’s 
adapter space that addresses all the flash memory to be 
used. Window size and base address are left to the sys- 
tem designer to decide, based on system design require- 
ments. Some hardware guidelines are: 


© Register-defined window size of either 4 KB, 8 KB, 
16 KB, or 32 KB 


© Register-defined base address in adapter space 
(C0000h to DFFFFh) 


For more detailed information on Microsoft’s Flash 
Filing System, consult the Microsoft Flash Filing Sys- 
tem OAK. 


2.4 Resident Flash Disk (RFD) and 
ExCA Architecture 


Many systems which use an RFA will also want to 
incorporate PCMCIA memory and I/O cards. If an 
RFD uses the same software architecture used for 
PCMCIA cards, less software duplication is present in 
systems containing both cards and RFDs. This section 
discusses the Intel Exchangeable Card Architecture 
(ExCA) as it applies to an RFD and a Flash Filing 
system. 


Most of this section was excerpted from the ExCA 1.1 
Specification. The reader is encouraged to obtain that 
document for more details not revealed in this discus- 
sion. Other documents are the PCMCIA PC Card 
Standard Release 2.0, the PCMCIA Card Services In- 
terface Specification, and the PCMCIA Socket Services 
Interface Specification Release 2.0. 


ExCA specifies a standard host system hardware and 
software interface for 68 pin, PCMCIA/JEIDA memo- 
ry and I/O cards. ExCA Release 1.10 defines the mini- 
mum hardware and software interfaces that card and 
system designers can rely on for basic compatibility 
across PC Cards, systems, and related software. By de- 
fining these interfaces, ExCA makes the PCMCIA goal 
of PC Card inter-operability a reality. 
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2.4.1 ExCA SOFTWARE INTERFACE 


The primary purpose of the ExCA Software Interface is 
to explicitly define a minimal set of socket control and 
resource access functions upon which higher-level PC 
Card Client device drivers can rely. A PCMCIA imple- 
mentor may incorporate a range of functions beyond 
the basic Memory Card Interface specified in PCMCIA 
1.0. For PCMCIA 2.0, three primary functional exten- 
sions to the specification exist. They are: I/O devices, 
L-XIP-mapped memory (“‘L” stands for LIM or Lotus, 
Intel, Microsoft), and E-XIP-mapped memory (“E” 
stands for Extended or Protected mode memory). 
While basic memory requirements can be met with a 
single, small memory-mapped window or even via an 
I/O approach, both XIP modes require direct-mapping 
interface capability, with very specific boundaries in the 
L-XIP mode. Without an ExCA-like hardware and 
software support for direct-mapped memory, XIP-for- 
matted cards cannot function. The ExCA socket hard- 
ware and software specifications define basic, clear 
compatibility definitions for PC cards, software drivers, 
and host systems. 
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ExCA allows PC Cards and sockets to be accessed by 
multiple PCMCIA-aware device drivers, configuration 
utilities and applications, with efficient and non-con- 
flicting use of system resources. An architectural dia- 
gram of ExCA functionality is shown in Figure 5. The 
primary components of the software interface are Sock- 
et Services and Card Services. Socket Services provides 
the lowest-level function set for socket hardware adapt- 
er control. Card Services allocates resources and coor- 


dinates PC Card-related activities for higher-level client 
device drivers. 
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MS Flash Filing System 
(FLASH.SYS) 


DOS Device Driver 
iCARD29.EXE 


Card 
Services 


Excal™ Defined 
Software 


82365SL™ 
Socket 
Services 


Resident Flash Disk 
Intel 82565SL Hardware Interface 
Flash Memory RFD 
Card Flash Memory 


Figure 5. By using the same software architecture used 
for PCMCIA cards, less software duplication is present in systems 
containing both cards and Resident Flash Disks. 


RFA Flash Disk 
Socket Services 
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2.4.2 ExCA SOCKET SERVICES 


ExCA Socket Services is the lowest-level software inter- 
face that directly controls PC Card sockets. Socket 
Services defines a software interface to manipulate 
socket adapter hardware in a way that is independent of 
hardware implementation. Socket Services defines sev- 
eral abstract resources which can be manipulated. An 
Adapter is the hardware that supports connecting one 
or more 68-pin PCMCIA Sockets to a host system, or 
in the case of a resident flash disk, the hardware that 
supports a memory interface only. A Socket is the 
hardware that supports a single 68-pin PCMCIA con- 
nector. A Window is the hardware that supports map- 
ping a region of system memory or I/O address space 
to a region of card memory or I/O address space. A 
Card is a PCMCIA card that is inserted into a socket. 
Example functions are: configure a socket for an I/O or 
memory interface, control socket power voltages and 
make callbacks for PC Card insertion and status chang- 
es. 


Socket Services handlers use minimal RAM so that 
they will fit within a ROM-BIOS. The Socket Services 
interface can be used during POST, and must be ROM- 
resident to support booting from a PC Card. The inter- 
face is accessed via an 8086-compatible register-based 
protocol, and invoked through software interrupt 1Ah, 
with functions starting at 80h. This interrupt is shared 
with the real-time CMOS Clock Driver. The Socket 
Services software interrupt is called with the proper set- 
tings in the host processor’s registers. The functions 
returns status via the Carry flag and registers specific to 
the function invoked. 


Multiple hardware socket adapter interfaces can be 
supported by chaining multiple Socket Services han- 
dlers. This includes providing Socket Services support 
for motherboard-resident flash memory arrays by treat- 
ing the control circuitry and memory array as if it were 
a PC Card single socket/card combination. 


2.4.3 ExCA CARD SERVICES 


Card Services is the interface used to manipulate 
ExCA-related system resources. Card Services is sub- 
divided into five functional categories: Client Services, 
Resource Management, Client Utilities, Bulk Memory 
Services, and Advanced Client Services. Client Services 
provide for client initialization and the callback regis- 
tration of clients. Resource Management provides basic 
access to available system resources, combining knowl- 
edge of the current status of system resources with the 
underlying Socket Services adapter control functions. 
Client Utilities perform common tasks required by cli- 
ents so that functions, such as CIS (Card Information 
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Structure) tuple access, do not need to be duplicated in 
each of the client device drivers. Bulk Memory Serv- 
ices provide read, write, copy, and erase memory func- 
tions for use by file systems or other generic memory 
clients that need to be isolated from memory hardware 
details. Advanced Client Services provide specific func- 
tions for clients with special needs. 


Card Services provide a packet-based request interface 
(i.e., uses a block of RAM for passing inputs and out- 
puts between the caller and the interface) which pro- 
vides a standard protocol for PC Card client device 
drivers to access cards and their required system re- 
sources. It provides separate registration and callbacks 
for card insertion and card status change event notifica- 
tions, allowing associated client device drivers to take 
the appropriate actions. For file system read, write, 
erase and copy operations, a special interface is provid- 
ed for Memory Technology Drivers (MTDs) which can 
handle the details of different memory technologies. 


NOTE: 
This interface is not used by iCARD29. Instead, the 
MTD functions are built into iCARD29. 


Resource Management provides a protocol for sharing 
resources within an environment, where previously the 
end-user was responsible for resolving resource con- 
flicts. Resource Management resolves resource conten- 
tions without end-user interaction. 


Advanced Client Services contains a ReturnSSEntry 
function which is essentially a direct bypass to Socket 
Services. Card Services require Socket Services to ma- 
nipulate PC Cards and socket hardware. ExCA client 
drivers should typically interact directly with Card 
Services and not Socket Services. 


Card Services is typically implemented as a device driv- 
er. Card Services provides function number AFh in the 
Socket Services interrupt 1Ah interface for real-mode 
operation. During initialization, Card Services deter- 
mines the state of the host environment. This includes 
determining available system memory, available I/O 
ports, IRQ assignments, installed PC Cards and socket 
state. How this is performed is implementation specific. 


2.4.4 iCARD29 FILE SYSTEM DRIVER 


iCARDRV2.EXE is an Intel developed, low-level, flash 


memory driver for the MS Flash Filing System. It pro- 
vides read, write, copy, and erase functions within the 
ExCA architecture and interfaces to a PCMCIA stan- 
dard Card Services 2.0 (which provides proper resource 
arbitration). iCARD29 is completely independent of 
other peer level drivers and performs no direct calls to 
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Socket Services. Support for Intel’s Series 1 and Series 2 
flash memory cards and the RFA flash disk is provid- 
ed. iCARD29 is also used to read ROM cards and 
read/write SRAM cards. 


2.4.5 RFD SOCKET SERVICES 


RFD “SocketServices” functions similar to ExCA 
SocketServices in that the software interface to manipu- 
late socket adapter hardware is preserved, but an RFD 
SocketServices does not control any sockets or cards or 
respond to card removal and insertion events. RFD 
SocketServices allows a resident flash disk implementa- 
tion, through chipset logic or external logic, to appear 
to ExCA software and the system as another Adapter 
using a single Window mechanism, accessing perma- 
nently installed flash memory on a motherboard. All 
the rest of ExCA SocketServices functions are kept as 
they relate to this definition. An example of a non- 
working RFD SocketServices function is using it to 
configure an I/O card. If requested to complete such an 
operation, RFA SocketServices will respond with 
“Function not supported.” 


For more information on the specific hardware design 
used for a Resident Flash Disk, refer to Section 3.5. 


2.5 XIP Graphical Users Interface 
(GUI) Overview 


Many GUIs exist today, but not all are configured to 
run in a minimized XIP mode for portables. Some de- 
signs may implement a simple DOS-based pen interface 
on top of an XIP DOS, like Communications Intelli- 
gence Corporation’s PenDOS", and add a single appli- 
cation like a forms recorder. Other designs may not use 
XIP DOS at all and the system design revolves around 
the XIP GUI requirements alone. 


Microsoft leads the rest of the software industry in XIP 
GUI development, releasing the Windows 3.1 ROM 
Development Kit in September of 1992 and recently 
introducing the Modular Windows Development Kit in 


January of 1993. Both are XIP GUI implementations . 


of the Windows GUI Operating System and are fully 
modularized for OEM configuration. Modularization 
assists OEMs by simplifying the streamlining of an 
O/S’s suitability to task by allowing the OEM to 
choose which functions are important and required for 
a particular design and which functions can be left out. 
Benefits to the OEM are: 


— Preserved API for using existing Windows applica- 
tions or new application development 


— Reduced development time and costs by using stan- 
dard Windows application development tools and a 
wide choice of Windows software developers 


— Ease of use for end-user 
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Modular Windows 


Microsoft’s Modular Windows Operating System uses a 
subset of the Windows 3.1 Operating System and in- 
cludes extensions supporting TV-based multimedia 
players. Target market is home entertainment, but 
could easily be adapted for machine control on factory - 
floors. The differences between Modular Windows and 
Windows 3.1 ROM are summarized below: 


— Reduced support for the Windows 3.1 application 
- programming interface (API) 


— Reduced support for Windows 3.1 extension librar- 
ies 


— New user-interface controls (instead of pull-down 
menus) 


— New support for hand-control input devices 


Software requirements are: 
e MS DOS 5.0 in XIP form 


System requirements are: 
© 80286 or greater CPU 
© 1 MB RAM minimum 
© 1 MB of XIP memory (Flash, EPROM, or ROM) 


Since the focus of this application note is personal com- 
puters, Sub-Notebooks and below, Modular Windows 
implementations will not be discussed. However, many 
of the principles of putting Modular Windows code in 
flash memory (memory maps, software tools, flash up- 
datability, etc.) are the same here as the Windows 3.1 
ROM example which is discussed later in this section. 


Windows 3.1 ROM Version 


Computers running Windows in ROM or XIP mode 
are very similar to standard PC running disk-based 
Windows. The only major exception is the presence of a 
large amount of XIP code storage in extended memory 
from which Windows executes, and a smaller amount 
of XIP code storage in adapter space. For the rest of 
this discussion, the Windows XIP code stored in ex- 
tended memory is referred to as HIROM.BIN and the 
small amount of Windows XIP code stored in Real 
Mode space is referred to as LOROM.BIN. 


Two modes of operation are possible for XIP Windows; 
Standard and Enhanced, just as on disk-based PCs. 
However, each require different system resources for 
the XIP Windows version. 
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For Standard Mode, Windows executes fully in ROM, 
leaving almost all the system RAM available for user 
programs. This means that all Windows “core code” 
including DOSX.EXE, USER.EXE, GDI, the Win- 
dows kernel and all drivers run from XIP storage 
space. Also, all shell programs, applets, fonts and other 
Windows resources are stored in and run from XIP 
storage space without being loaded into RAM. 


Enhanced Mode Windows must execute partially from 
RAM. Enhanced Mode components such as 
WIN386.EXE and VxDs (virtual device drivers) must 
be loaded into RAM from some type of disk (a flash 
disk, ROM disk, or flash card) for execution, as their 
code writes back to their execution location from time 
to time and creates errors if loaded into XIP code stor- 
age such as flash memory. Components shared between 
modes, specifically USER.EXE, GDI, the kernel and 
drivers, continue to run from their stored locations in 
XIP address space. 


Additionally, for either Standard or Enhanced modes, 
all Windows 3.1 features are supported in XIP Win- 
dows. The only limiting factors are the amounts of 
available RAM, XIP storage and, in the case of En- 
hanced mode, disk space. | 


Adding Applications 


The Windows 3.1 ROM Development Kit (RDK) can 
add any Windows executable program or application 
into the main XIP binary image file HIROM.BIN. The 
application must conform to the XIP application re- 
quirements specified in the Windows 3.1 Technical 
Specification. Microsoft is capable of supplying XIP 
versions of Word for Windows, Excel, Microsoft Mail 
and Microsoft Works but must be developed between 
an OEM and Microsoft on a platform-by-platform ba- 
sis. 


Once the O/S and application functionality is deter- 
mined and the build script CONTENTS.ROM edited, 
the RDK produces two binary images: the large 
HIROM.BIN Extended mode image containing O/S 
and application code, and the small Real mode 
LOROM.BIN image containing the listing of all the 
XIP code contained in HIROM.BIN. After both XIP 
Windows binary files are loaded into flash memory and 
the system is up and running, clicking on an application 
causes the XIP Windows kernel to search its internal 
listing (LOROM.BIN) for an XIP image module first. 
If the image is not found within the XIP listing, the 
Windows kernel then searches the file paths present at 
runtime to try and load the application from its current 
file directories. If the program is not found within 
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file directories, XIP Windows returns “Application 
missing, file not found.” Additions of other extensions 
to the XIP image such as multimedia support and Pen 
Windows are added in a similar manner. 


2.6 XIP GUI Implementation 


As mentioned earlier, XIP Windows requires two mod- 
ules; a small amount of XIP storage in device adapter 
space called LOROM.BIN, and a larger amount of XIP 
storage called HIROM.BIN in extended memory 
space. The LOROM.BIN file contains information 
about the modules loaded in the HIROM.BIN XIP (see 
Figure 6) image and must be accessed in real mode by 
three modules, WIN.COM, RSWAP.EXE, and 
WIN386.EXE. Additionally, portions of the DOS ex- 
tender (DOSX.EXE) must be able to run in real mode 
and are therefore located in the LOROM.BIN XIP 
image. The information the three modules look for is 
contained in the ROM Table Of Contents (ROMTOC), 
also located in LOROM.BIN and contains general in- 
formation about both XIP images (small and large), 
entry point addresses for initialization, and a list of the 
executables stored in the large XIP image. 
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Figure 6. 16 MByte XIP GUI Memory Map 


The extended memory XIP image contains the bulk of 
the system’s code and data segments, EXE headers, and 
a prototype Local Descriptor Table (LDT) which is a 
data structure defining the addresses, sizes and types of 
segments used by 80286, Intel386™4, or Intel486T™ 
processors. For more information on a Windows 3.1 
XIP-based system, please refer to the Microsoft Win- 
dows 3.1 ROM Development Kit. 
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Software Requirements 
e MS DOS 5.0 or equivalent in XIP mode 


¢ Software Utility to load both small and large XIP 
images into flash memory 


e For Enhanced Mode disk space requirements, MS 
Flash Filing System 2.0 combined with ExCA soft- 
ware for a Resident flash disk. 


System Requirements 
© 80286 CPU or greater 


_ © RAM: Minimum of 1 MB for Standard Mode or 
2 MB for Enhanced mode 


e XIP Store: Minimum of 2 MB for Standard Mode, 
3+ MB for Enhanced mode 


@ Flash Disk Store: Zero for Standard Mode, 2 MB 
for Enhanced mode 


For this particular design example, Enhanced mode 
functionality is used to show a full implementation of 
Windows. An RFD is used to load WIN386.EXE, 
VxDs and all the *.INI and *.GRP files. A complete 
listing of the CONTENTS.ROM file used by the Win- 
dows ROM Image Builder utility to create an XIP 
Windows system is shown in Appendix D. The Win- 
dows RDK Enhanced Full sample CONTENTS.ROM 
file is used as a template and edited to locate the 
LOROM.BIN file at C8000h and is a total of 16 KB. 
The HIROM.BIN file is located at CO0000h and is a 
total of 3.6 MB. 


2.7 Pen Extensions 


Microsoft’s Windows for Pen Computing is an exten- 
sion to Microsoft Windows version 3.1 and has its own 
SDK. Pen Windows Extensions do not require any 
changes to existing Windows 3.1 applications and a se- 
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lection of pen recognizer drivers come bundled in the 
SDK provide for fast development of a pen-based sys- 
tem. In particular, the Wacom PL-100V pen tablet and 
VGA graphics card can be added to an ISA bus slot for 
early debug and pen software development. 


All the Pen Windows extensions are directly executable 
within the HIROM XIP image and can be added to the 
CONTENTS.ROM listing. 


3.0 HARDWARE 


This section describes the general hardware require- 
ments for an RFA design, then discusses a specific im- 
plementation using the SL architecture as an example 
(primarily due to the built-in ISA Sliding Window). 
Many of the concepts presented here can easily be in- 
corporated into new chipsets designs to take advantage 
of the benefits flash memory brings to solid-state de- 
signs. 


3.1 Resident Fiash Disk 
Implementation 


As stated in Section 2.3, the MS Flash Filing System 
requires a hardware mapping window in Real Mode 
address space. This window is similar in function to an 
EMS mapping window, but unlike EMS this window 
interfaces directly to flash memory. The SL Superset 
provides an example of just such a mapping, using in 
the ISA Sliding Window. The window is configured via 
the SL’s ISEAWINDOW register and has a fixed base 
address of DOO00h and a fixed size of 64 KB. By setting 
the correct address in the register, the full 16 MB ISA 
address space is viewable in 64 KB increments. Addi- 
tionally, the register defines access to the 16 MB flash 
disk address space made available by a separate flash 
disk Chipselect (see Figure 7). 
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Figure 7. Flash Disk Mapping 
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Although the built-in functionality of the ISA Sliding 
Window is quite nice, the large 64 KB footprint of the 
window in Real Mode address space is difficult to work 
around. For a non-SL implementation, smaller, more 
flexible sliding windows are possible through external 
logic (FPGAs or EPLDs) or hopefully from future PC 


chipsets desiring to provide the capability the flash 
memory offers. The hardware requirements are simply: 


1. A Window base address that appears in Real Mode 
memory somewhere in adapter space (C0000h to 
DFFFFh) that is also register definable. 


2. A Window size that is also register definable for 
either 4 KB, 8 KB, 16 KB, or 32 KB. 


These two options provide a level of flexibility for an 
OEM’s system implementation and reduces the memo- 
ry footprint in adapter space. 


The flash disk address mapping in Figure 7 shows the 
flash disk and ISA bus address maps together. The SL’s 
ISA Sliding window allows 64 KB blocks of the flash 
disk address space to be mapped into the Real mode 
area from D0000h to DFFFFFh for access by the MS 
FlashFile System. For some ideas on how to implement 
an external logic flash disk implementation, see AP-343 
“Solutions for High Density Applications Using Intel 
Flash Memory,” order number 292079. The application 
note describes a complete design for an ISA Bus add-in 
card. A local bus design can be derived from the ISA 
Bus implementation or the SL implementation logic 
discussed in Section 3.6, Schematic Overview. 


3.2 XIP DOS Implementation 


As stated in Section 2.2 DOS in Flash Implementation, 
MS DOS 5.0 ROM Version is built assuming the 
E0000h segment location and also consists of a ROM 
Disk located in extended memory at F90000h. The only 
reason for the ROM disk location is to avoid 386SL co- 
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processor errata at the 8 MB location and window base 
address constraints, which must be divisible by the win- 
dow size in use. In non-SL designs, the ROM Disk can 
be located anywhere above 1 MB in a NON-cacheable 
region. The design example uses Intel’s 2 Mb, 
28F002BX-T boot block flash memory. This device is 
organized with varying sized blocks; a 16 KB hardware 
lockable boot block, two 8 KB separately erasable Pa- 
rameter Blocks, and separately erasable 96 KB and 
128 KB main code blocks. To unlock and allow pro- 
gramming and erasure of the boot block, an additional 
12V must be applied to the PWD# pin, thereby guar- 
anteeing hardware protection. The benefit of using boot 
block architecture is that in the unlikely event that 
something happens during a BIOS code update, the sys- 
tem can recover using the kernel code in the boot block 
to initialize enough of the system to access a floppy 
drive or memory card socket to load in BIOS update 
code and a BIOS binary file. 


Using a 2 Mb (256 KB) device enables the design to use 
a single memory chip for 4 separate code modules: the 
standard AT compatibility BIOS (64 KB), MS DOS 5.0 
ROM (64 KB), Video BIOS (32 KB), and Power Man- 
agement Code (32 KB). The sum of all 4 modules is 
greater than 128 KB and if mapped straight down from 
the top of the 1 MB address space, could cover both the 
BIOS and all of the adapter space. To avoid this con- 
flict, some chipset designs physically position the BIOS 
function at the top of the 16 MB memory map, then use 
64 KB mapping windows to position the correct block 
between E0000h and FFFFFh. 


The SL Superset provides a second BIOS ROM chipse- 
lect enabling only one 128 KB portion to appear at 
E0000h to FFFFFh at a time. Additionally, the SL Su- 
perset provides an ISA Sliding Window which allowed 
windowed access into protected mode space. Figure 8 
shows how each module is mapped into the boot block 
flash memory. 
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Figure 8. Boot Block Mapping 


The boot block flash memory chip is physically located 
at the top of the 16 MB address space, but the SL Su- 
perset logically locates the top 128 KB of the chip into 
Real Mode address space just below 1 MB. Additional- 
ly, an exclusive OR gate is tied to the highest order 
address line, flipping the 2 Mb boot block chip at its 
mid point. This places the locked boot block just under 
the first 128 KB of the part, while the other 128 KB 
containing the AT System BIOS and MS DOS 5.0 
ROM appears at the top of the device. This is done to 
position the boot block (which contains BIOS recovery 
code) out of the IBM BIOS compatibility table area, 
allowing access to the AT System BIOS and MS DOS 
ROM code. 
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When the system boots, the processor jumps to the AT 
BIOS location by default. As the system is booting, the 
BIOS enables the ISA Sliding Window to access the 
other 128 KB of boot block flash memory, and pro- 
ceeds to copy the Power Management code to its spe- 
cial location within the System Management Mode 
space. Next, the BIOS copies the Video BIOS code into 
shadow memory at C0000h to C7FFFh and turns off 
the ISA Sliding Window. The BIOS then scans the MS 
DOS 5.0 ROM adapter code, and allows MS DOS 
ROM to hook INT 19h, and finishes the rest of its 
POST before turning control over to DOS by issuing 
INT 19h. 


Intel. 
3.3 XIP GUI Implementation 


As stated earlier, Windows 3.1 ROM Version takes up 
about 3.6 MB of extended address space 
(HIROM.BIN) and 16 KB of Real mode adapter ad- 
dress space (LOROM.BIN). HIROM.BIN can be lo- 
cated anywhere above 1 MB and should probably be 
high enough above the DRAM address space to allow 
additional DRAM to be added to the system by the 
end-user. Ideally, the system design should be able to 
cache the area where the Windows HIROM XIP code 
is located. This allows the system to take advantage of 
XIP code locality since XIP code should produce a 
very high cache hit ratio. Since the 28FOO8SA Flash- 
File memory is a x8 device, x16 access is accomplished 
by pairing two devices for a LOW Byte HIGH Byte 
configuration. This creates an erasable block size of 
128 KB. 


The LOROM.BIN file has a couple of implementation 
options. One method is to use a spare block out of the 
extended memory XIP region. This method requires 
external logic to decode the specific adapter space ad- 
dress dedicated to the LOROM function, and generate 
a chipselect to the last block of flash memory. Since the 
LOROM.BIN file size is only 16 KB and the smallest 
erasable block size is 128 KB, 112 KB of the block is 
left unused. Given that the HIROM and LOROM files 
are updated together, the HIROM file could feasibly 
use the extra space if necessary. 


Another option for the LOROM file is to use some free 
storage space within the 2 Mb boot block flash memory 
chip. The file could then be copied to the correct adapt- 
er space shadow RAM location at boot time. Copying 
the LOROM.BIN file can occur at the same time that 
Video BIOS and Power Management code are copied. 
This method provides update capability while reducing 
external logic requirements. The only hinge factor is 
getting the system’s BIOS code to copy the file before 
or during POST. 


Either option is possible. The choice is dependent on 
determining which is easier, modifying hardware or 
modifying a BIOS bootup process. 


3.4 Chipset Considerations 


Chipset designers interested in implementing an RFA- 
ready chipset should consider the following recommen- 
dations for RFA hardware requirements: 


Flash BIOS > 128 KByte 

@ Minimally, include a Flip Bit on the highest order 
address line. This allows 128 KB pages to move in 
and out of the same 128 KB address space. 
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© Position the BIOS at the top of 16 MB or 32 MB 
address space, keeping the flip bit and include a win- 
dow mapping mechanism similar to an EMS-like 
window. This window provides temporary Real 
mode access of the 2nd 128 KB of BIOS code stor- 
age. 


RFD Functionality 
e Include a built-in Flash disk Chipselect to minimize 
external logic 


e Add an EMS-like mapping window 


— Register defined, base address between CO000h 
and DFFFFh 


— Register defined window size adjustable 4 KB, 
8 KB, 16 KB, and 32 KB 


— Register address capability to 64 MB RFD 


XIP Code Functionality 
e Include a built-in XIP Flash Chipselect 


e Add 2 register defined, cacheable windows 
— Adjustable base address anywhere above 1 MB 
— Size adjustable 2 MB, 4 MB, or 8 MB 


3.5 SL Based Design 


Lacking an off-the-shelf, RFA-ready chipset and sys- 
tem, an SL Superset design is used as an example. To 
achieve as close to local bus access times as possible, the 
SL’s Peripheral Interface (PI) Bus is used. The PI Bus 
is asynchronous and runs a CPU cycles plus one addi- 
tional wait state. 


To position the FlashFile memory on the PI Bus into 
the system’s address map, a spare Video Window regis- 
ter (GABCR) is used (see Figure 9). For the design 
example, a base address of CO0000h is used combined 
with a window size of 4 MB. The CO00000h base address 
avoids some conflicts with 386SL systems at the 8 MB 
address location. Since the GABCRs window base ad- 
dress must be divisible by its size, the 12 MB address 
made the most sense (avoiding the 8 MB location) 
while being high enough to allow at least 8 MB of sys- 
tem RAM. For any other XIP system design, any base 
address should be usable. Although the GABCR regis- 
ter positions the FlashFile memory correctly and routes 
all system address map accesses to C00000h to 
FFFFFFh to the PI Bus, by the fact that the GABCR 
is a graphics window, it is defined as a non-cacheable 
window. 


@ Include a cache enable/disable bit within the regis- 
ter 


These requirements work for non-Intel architecture just 
as well as for the Intel architecture. 
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3.6 Schematic Overview 


Appendix F contains schematics for the SL Superset 
example design. This section reviews the major portions 
of the schematic. 


Even though the SL Superset provides a flash disk Win- 
dow and Chipselect, two EPLDs are needed to decode 
the flash disk Chipselect from Video Chipselects, while 
the XIP flash memory required externally generated 
chipselects. Additional logic is also needed to decode 
the LOROM.BIN stub at CC000h and route the access 
to the highest block of XIP Memory. 


The RFA example design uses both an Intel 85C090-15 
and an Intel 5AC312-25 EPLD to provide board con- 
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trol logic. This logic generates flash memory chip en- 
ables, flash memory control signals, ROM Stub decod- 
ing, PI bus cycle decoding and bus cycle termination, 
and enables the mode registers. For details on the 
EPLD equations, see Appendix E. 


85C090 


The Intel 85C090 also controls the mix between how 
much flash memory is used for Resident Flash Disk 
Memory (FDM) and how much flash Disk Memory 
(RFD) and how much flash memory is used for XIP 
Memory. The EPLD description files in Appendix E 
show how to change the equations to obtain the desired 
mix needed for any particular OEM’s implementation. 


BR ‘ 
intel. 
5AC312 Mode Registers 


The 5AC312 provides two registers to control Vpp, 
power down, and the Ready Interrupt. The registers 
are written and read with PI Bus Memory cycles to the 
upper 64 KB of the Flash Disk Address Plane. This 
space is otherwise unused; no flash memory resides 
there. Address assignments in the flash disk plane are 
as follows: 


FFO000h Power Control Register (Wt/Rd) 
FF0002h Interrupt Control Register (Wt/Rd) 
FF0004h (Reserved) 


FF0006h Clear Flash Disk Memory READY 
Interrupt (Wt only) 


The Clear Flash disk Memory READY Interrupt is not 
used with FlashFile System 1.0. It is intended to be 
used with the next file system from Microsoft. The 
above assignments alias every 8 Bytes (4 words) up to 
FFFFFEh. 


The Power Control Register bits are defined as follows: 


Bit 
0 Enable all Flash Memory Vpp 
(if jumper E9-E10 installed) 
1 (Reserved; reads as a zero) 
2 (Reserved; reads as a zero) 
3 Power Down all flash memory 
4-15 Undefined 


The Interrupt Control Register bits are defined as fol- 
lows: 
Bit 
0 Enable Flash Memory READY Interrupt 
1 Flash Memory READY Interrupt (Read only) 
2 Flash Memory Any Zone Busy (Read only) 
3 (Reserved; reads as zero) 
4-15 Undefined 


Reserved bits should be written as zeroes; they will read 
as zeroes. Undefined bits should be written as zeroes; 
they may read as either zeroes or ones. 


Cold boot (RSTDRV) clears all defined bits in the reg- 
ister. Warm boot (CTRL-ALT-DEL) does not affect 
the contents of the register. 


The Flash Memory READY interrupt is cleared by 
writing to address FF0006h in the flash disk Address 
plane. The data written is not interpreted; it should be 
all zeros. 
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A major power consumer on the RFA example design 
board is the 85C090 EPLD. This is due to using Turbo 
Mode to quickly decode the PI Bus signals and mini- 
mize RFA access time. Unfortunately, this causes a 
constant current draw of 160 mA. The EPLD’s Normal 
mode cannot be used since there is no advance warning 
of an XIP flash memory access. 


PRDY # Enable Jumper 


The PI Bus signal PRDY# has a very weak pull-up 
resistor on the motherboard. Consequently, it has to be 
driven high (inactive) for a short time at the end of each 
cycle. Timing for this logic comes from the early taps 
on the delay line as follows: 


100 Nanosecond delay line 
(SXTTLDM-121)E4-E5 


200 Nanosecond delay line 
(SXTTLDM-125)E4-E3 


Power Control 


The purpose of the SMOUT4 signal was to allow the 
RFA Daughter board to perform a local standby, pow- 
ering down various devices on the RFA Daughter 
board. However, since the EPLD must remain powered 
on until Global suspend, and consumes a high amount 
of current compared to the FlashFile power consump- 
tion, local standby was not implemented. 


4.0 SOFTWARE UTILITIES 


A few software utilities need to be created to load the 
binaries created for XIP code implementations. 


4.1 RFA Diagnostic 


It is highly recommended that system designers develop 
simple diagnostic tools to test the hardware at a very 
low level (i.e., write byte, write word, read word, erase 
block). Such a tool proves invaluable when debugging 
new hardware and software designs and resolving hard- 
ware and software conflicts. 
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4.2 RFA Binary Loader 


The RFA Binary files HIROM.BIN, LOROM.BIN, 
and ROM Disk must all be loaded into Protected Mode 
from Real Mode. This can be accomplished a number 
of ways: 


1. Use a DOS Extender. This provides a quick method 
to create a utility using the tools a DOS extender 
provides. However, licensing may prove to be diffi- 
cult or expensive. 


2. Using BIOS-based extended memory calls. These 
actually worked quite nicely and reliably, but 
proved to be slow and doubled the time to erase and 
program HIROM.BIN. 


3. Putting the processor in flat mode. This method al- 
lows for fast, direct access to the extended memory, 
but cannot be done under windows. 


For lab testing, our binary loader used a simple file 
name plus command line parameters. A system for end- 
users would need a more elaborate user interface to 
guide them through the software update. Some basic 
software requirements outside of the basic file read/ 
write capabilities and command line parsing for the 
flash memory Binary Loader are: 


© Incorporate basic flash memory program and era- 
sure commands. These software drivers are available 
for both ASM86 and “C” in Application Note-360 
“28FO08SA” Software Drivers, order number 
292095-002. This application note addresses things 
like read device identifier, Vpp ramp time, x8 and 
x16 parallel programming and block erasure by pro- 
viding proven, tested routines for each. 
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® Choose a method of Protected Mode access that 
makes the most sense for you. 


e Allow for specific base addresses to be entered by 
the user, while within the program automatically de- 
termining what block and the number of blocks to 
be erased from the base address and binary file size. 


5.0 SUMMARY 


This application note discussed a new system architec- 
ture based on solid-state software and hardware design 
concepts. This new architecture is based on using flash 
memory for the following; BIOS + DOS code storage, 
a nonvolatile RAM disk or RFD, and as XIP GUI 
code storage or RFX. Specific flash memory compo- 
nent and PCMCIA card information is found in their 
respective datasheets. Contact your local Intel or distri- 
bution sales office for more information or to obtain 
assistance in evaluating Boot Block or FlashFile memo- 
ry components, as well as Intel’s product line of 
PCMCIA Flash Memory Cards. 
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APPENDIX A 
ADDITIONAL PUBLICATIONS 


> Intel "28FOO8SA Hardware Interfacing" Application Note 
Order number 292094 


> Intel "28FOO8SA Software Drivers" Application Note 
Order number 292095 


> Intel "Power Supply Solutions for Flash Memory" Application Note 
Order number 292092 


> Intel 85C090 24-Macrocell CHMOS EPLD 
Order number 290247 


> Intel SAC312 12-Macrocell CHMOS EPLD 3 
Order number 290247 
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APPENDIX B 
MS DOS ROM IMAGE DESCRIPTION 


HHHHHHHHHHRHRHAHHAHARRARAH RRA HAHAHAHAHAHA HAHAHAHAHAHA 


# RFA ROM DOS Description File # 
# ROM image description file for 64K of ROM space at # 
# E0000-EFFFF and one 256K ROMDISK module at F90000 # 


HHHHHHHHHHHHHHHHHHRHHAARAARHHHARARARR RAHA RRR RRR RRR 
# Actual file sizes created: Three 32K modules 


ROM1=Int 19 hook and Resident DOS Code 
ROMI1SIZE=8000 


ROM1TYPE=SEG 

ROM1ADDR=E000 

ROM1CHKSUM=YES 

ROM1INUMBLOCKS=40 
ROMIFILES=..\romhead\romboot.bin ..\dos\resdos. 16 


ROM2=COMMAND ROM Har Res. BIOS Code Bootstrap loader Resident Command Code 
ROM2SIZE=8000 
ROM2MAX=7FFF 
ROM2TYPE=SEG 
ROM2ADDR=E800 
ROM2CHKSUM=YES 
292097-10 
ROM2NUMBLOCKS=40 
ROM2FILES=..\cmd\command\romhead. bin ..\bios\resbio.16 \ 
..\romload\romload.sys ..\cmd\command\rescom.16 ..\dos\romdos.sys 


ROM3=Command interpreter 
ROM3SIZE=10000 


ROM3ADDR=F90000 


ROM3FILES=..\cmd\command\command. 16 ..\bios\rombio.sys 
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APPENDIX C 
ROMDISK CONFIG.SYS AND AUTOEXEC.BAT 


AUTOEXEC.BAT 

@echo off 

prompt $P$G 

set path=c:\;d:\rdk 1 0\build\disk;d:\utils;d:\diags; 
c:\doskey 

doskey d=dir $1 $2 
d:\rdk10\build\disk\smartdrv.exe 1024 1024 

set TEMP=d:\ 

ver /r 

echo "MS DOS ROM, Card & Flash Disk SS 2.0, MS FlashFile System 2," 
echo "and Windows 3.1 ROM " 


CONFIG.SYS 
DEVICE=c:\HIMEM.SYS 
break=on 

buffers=40 

files=40 

lastdrive=H 

DOS=HIGH,UMB 

REM SEKEKESKKSKSEKKSEKSEKCKCAKSESCKSCKKKSEKKKKKSEKSEKKKSKSESEKKKKKKSES 
REM FlashFile System Drivers 
Device=C:\rfaslss.sys 
Device=C:\ss365sl.exe 
Device=C:\cs.exe 
Device=C:\rtinit.exe 
Device=C:\icard29.exe 
Device=C:\ms-flash.sys 


REM KKEKKEEKCKEKEKESSEKKKKKKKKKKKSKSKKSEKKKKKKKKEKKKKKEKKEKE 
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APPENDIX D 
WINDOWS 3.1 CONTENTS.ROM 


NOTE: Semi-colons denote a commented-out line which is NOT added to the HIROM Binary file. 


EXESEKESSEKESESSKSESSSSEKSESSSSESKKKESKSESKEKSESESESES 
b 


; Windows 3.1 ROM Development Kit (RDK) 1.0 
; Sample ROM Description File 
; Copyright Microsoft Corporation, 1992 


Enhanced Mode, Full 
- 10/20/92 Removed TT Fonts 


ROMS 


; Specifies length of ROMs and the linear addresses 
; at which they are to appear. 


; Name Address Length (max) 


LoROM 08000 004000 : 16k 
HiROM C00000 3FFCOO : 4 Mb 


TABLES 


; Specifies information for tables to reside in ROM. 


ROMTOC 100 LoROM ; ROMTOC entries 
NUMFILENT 14 ; FILES entries 
LDT 1024 HiROM 256 ; Local Descriptor Table 
; WINFLAGS 13 ; 286 version; Value is in HEX 
WINFLAGS 15 ; 386 version; Value is in HEX 
; SYSDIR system ; Windows directory on disk (optional) 
ROMVERSION 1000 - | = masked ROM, 000 = OEM version 


MODULES 


; Specifies modules to be loaded into ROM. 
- Format is as follows: 


; Module SEG File ROM Flags Comments 


’ 


; Kernel 


DOSX.EXE %ROMFILES%dosx.exe LoROM NOEXEHDR : Std conde MS DOS extender 
SEG 2 HiROM ; DXDGROUP - Copy from ext with INT 15h 
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SEG 3 HiROM ; DXPMCODE 
> KERNEL.EXE %ROMFILES%krnl286.exe HiROM ; 286 kernel 
' KERNEL.EXE %ROMFILES%krmnl386.exe HiROM ; 386 kernel (ROM version) 
; Drivers (Replaceable) 
SYSTEM.DRV %ROMFILES%system.drv HiROM ; System 
KEYBOARD.DRV %ROMFILES%keyboard.drv HiROM ; Keyboard 
SEG 10 COMP ; Do not remove! 
; Display 
; VGAROM2.DRV %ROMFILES%vgarom2.drv HiROM ; 286 VGA 
VGAROM3.DRV %ROMFILES%vgarom3.drv HiROM ; 386 VGA 
; SVGAR2.DRV %ROMFILES%svgar2.drv HiROM ; 286 Super VGA 
; SVGAR3.DRV %ROMFILES%svgar3.drv HiROM ; 386 SuperVGA 
MOUSE.DRV %ROMFILES%mouse.drv HiROM - Mouse 
SEG 2 RAM COMP NORELOC : Do not remove! 
; NOMOUSE.DRV %ROMFILES%nomouse.drv HiROM ; No mouse | 
COMM.DRV %ROMFILES%comm.drv HiROM ;: COM, LPT 
SEG 2 RAM COMP NORELOC ; Do not remove! 
SEG 3 COMP ; Do not remove! 
MMSOUND.DRV %ROMFILES%mmsound.drv HiROM ; Sound 
; Core 
GDILEXE %ROMFILES%gdi.exe §HiROM ; ROM version 
USER.EXE %ROMFILES%user.exe HiROM - ROM version 
SEG 3 RAM COMP NORELOC ; Do not remove! 


; Non-Replaceable System DLLs 


SHELL.DLL %ROMFILES%shell.dll HiROM - Shell APIs 
LZEXPAND.DLL %ROMFILES%izexpand.dil HiROM ; Expansion 
WIN87EM.DLL %ROMFILES%win87em.dll HiROM ; Math emulator 

; Replaceable System DLLs 

COMMDLG.DLL %ROMFILES%commdlg.dll HiROM STUB ; Common dialogs 
OLECLI.DLL %ROMFILES%olecli.dil HiROM STUB - OLE Client 
OLESVR.DLL %ROMFILES%olesvr.dil HiROM STUB ; OLE Server 
TOOLHELP.DLL %ROMFILES%toolhelp.dil HiROM STUB ; Tool Help DLL 
DDEML.DLL %ROMFILES%ddeml.dll HiROM STUB ; DDE 

VER.DLL %ROMFILES%ver.dil HiROM STUB : Version DLL 

: Multimedia Extensions 

MMSYSTEM.DLL %ROMFILES%mmsystem.dll HiROM STUB ; Multimedia 
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SND.CPL %RETAIL%snd.cpl HiROM ; Sound icon 
MPLAYER.EXE %RETAIL%mplayer.exe HiROM ; Media Player 
SOUNDREC.EXE “%RETAIL%soundrec.exe HiROM ; Sound Recorder 


; Advanced Power Management (APM) 


; POWER.DRV %RETAIL%power.drv HiROM ; APM driver 

; Shell Programs 

PROGMAN.EXE %RETAIL%progman.exe HiROM ; Program Mgr 
WINFILE.EXE %RETAIL%winfile.exe HiROM ; File Manager 
TASKMAN.EXE %RETAIL%taskman.exe HiROM ; Task Manager 
WINHELP.EXE %RETAIL%winhelp.exe HiROM ; Windows Help 
WINTUTOR.EXE %RETAIL%wintutor.exe HiROM ; Tutorial 


- Control Panel 


DRIVERS.CPL %RETAIL%drivers.cp! HiROM ; Drivers icon | 
MAIN.CPL %ROMFILES%main.cp! HiROM : Main icons 3 
CONTROL.EXE %RETAIL%control.exe HiROM ; Control Panel 

; Printing Support 

; PRINTMAN.EXE %RETAIL%printman.exe HiROM ; Print Mgr 

; UNIDRV.DLL %ROMFILES%unidrv.dil HiROM ; Uni driver 

; DMCOLOR.DLL %ROMFILES%dmcolor.dll HiROM ; Uni driver 


; System Fonts 


VGASYS.FON %RETAIL%vgasys.fon HiROM ; System (VGA) 


VGAFIX.FON %RETAIL%vgafix.fon | HiROM ; Fixed pitch 
VGAOEM.FON %RETAIL%vgaoem.fon HiROM ; OEM 

; Bitmap Fonts 
COURE.FON %RETAIL%coure.fon §HiROM ; Courier (VGA) 
SERIFE.FON %RETAIL%serife.fon HiROM ; MS Serif (VGA) 
SMALLE.FON %RETAIL%smalle.fon HiROM ; Small (VGA) 
SSERIFE.FON %RETAIL%sserife.fon HiROM > ; MS Sans Serif (VGA) 
SYMBOLE.FON %RETAIL%symbole.fon HiROM ; Symbol (VGA) 

; Plotter Fonts 
MODERN.FON %RETAIL%modern.fon HiROM ; Modern 
ROMAN.FON %RETAIL%roman.fon HiROM ; Roman 
SCRIPT.FON %RETAIL%script.fon HiROM ; Script 

; TrueType Fonts ----------------------------------------- 
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ARIAL.FOT %RETAIL%arial.fot © HiROM ; Arial 
ARIALBD.FOT %RETAIL%arialbd.fot HiROM ; Arial Bold 
ARIALBI.FOT %RETAIL%arialbi.fot HiROM : Arial Bold Italic 
ARIALI.FOT %RETAIL%ariali.fot ©HiROM ; Arial Italic 
*COUR.FOT %RETAIL%cour.fot HiROM - Courier New 
; COURBD.FOT %RETAIL%courbd.fot HiROM - Courier New Bold 
; COURBI.FOT %RETAIL%courbi.fot HiROM - Courier New Bold Italic 
* COURIL.FOT %RETAIL%couri.fot © HiROM ‘ Courier New Italic 
; SYMBOL.FOT %RETAIL%symbol.fot © HiROM ; Symbol 
- TIMES.FOT %RETAIL%times.fot © HiROM : Times New Roman 
; TIMESBD.FOT %RETAIL%timesbd.fot HiROM - Times New Roman Bold 
; TIMESBI.FOT %RETAIL%timesbi.fot HiROM ; Times New Roman Bold Italic 
; TIMESI.FOT %RETAIL%timesi.fot HiROM ; Times New Roman Italic 
WINGDING.FOT %RETAIL%wingding.fot HiROM ; WingDings 
; MS DOS App Support 
VGA.3GR %RETAIL%vga.3gr HiROM ; Enh mode grabber 
WINOLDAP.MOD %RETAIL%winoldap.mod HiROM ; Std mode MS DOS app support 
SEG 2 RAM COMP NORELOC ; Do not remove! 
WINOA386.MOD %RETAIL%winoa386.mod HiROM ; Enh mode MS DOS app support 


SEG 1 RAM COMP NORELOC 
SEG 2 RAM COMP NORELOC 
SEG 5 RAM COMP NORELOC 


- Do not remove! 
: Do not remove! 
‘ Do not remove! 


DOSAPP.FON %RETAIL%dosapp.fon HiROM ; MS DOS app window fonts 
EGA80WOA.FON %RETAIL%ega80woa.fon HiROM 

EGA40WOA.FON “%RETAIL%ega40woa.fon HiROM 

CGA80WOA.FON “%RETAIL%ega80woa.fon HiROM 

CGA40WOA.FON %RETAIL%cga40woa.fon HiROM 

; Applets 

CALC.EXE %RETAIL%calc.exe HiROM - Calculator 
CALENDAR.EXE %RETAIL%calendar.exe HiROM : Calendar 
CARDFILE.EXE %RETAIL%cardfile.exe HiROM - Cardfile 
CHARMAP.EXE “%RETAIL%charmap.exe HiROM ; Character Map 
CLIPBRD.EXE %RETAIL%clipbrd.exe HiROM ; Clipboard Viewer 
CLOCK.EXE %RETAIL%clock.exe HiROM ; Clock 
NOTEPAD.EXE %RETAIL%notepad.exe HiROM ; Notepad applet 
PACKAGER.EXE %RETAIL%packager.exe HiROM ; Packager applet 
PBRUSH.DLL %RETAIL%pbrush.dll HiROM ; for Paintbrush 
PBRUSH.EXE %RETAIL%pbrush.exe HiROM ; Paintbrush 
PIFEDIT.EXE %RETAIL%pifedit.exe HiROM ; PIF Editor 
RECORDER.DLL %RETAIL%recorder.dll HiROM ; for RECORDER.EXE 
RECORDER.EXE %RETAIL%recorder.exe HiROM : Recorder 
SOL.EXE %RETAIL%sol.exe HiROM : Solitaire 

; TERMINAL.EXE %RETAIL%terminal.exe HiROM ; Terminal 
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WINMINE.EXE %RETAIL%winmine.exe 


HiROM 
WRITE.EXE %RETAIL%write.exe §HiROM 
; Applications 
FILES 


; Specifies optional files to be installed into ROM. 
; TrueType TTF font files are specified in this section. 


- ROM Name 


bd 


Path 


ROM 


; TrueType Data 


ARIAL. TTF %RETAIL%arial.ttf HiROM 
ARIALBD.TTF %RETAIL%arialbd.ttf HiROM 
ARIALBI.TTF %RETAIL%arialbi.ttf, HiROM 


ARIALLTTF %RETAIL%ariali.ttf HiROM 

* COUR.TTF %RETAIL%cour.ttf HiROM 

* COURBD.TTF %RETAIL%courbd.ttf HiROM 
; COURBI.TTF %RETAIL%courbi.ttf HiROM 
> COURILTTF %RETAIL%coun.ttf HiROM 

; SYMBOL.TTF %RETAIL%symbol.ttf HiROM 
>; TIMES.TTF %RETAIL%times.ttf HiROM 


- TIMESBD.TTF %RETAIL%timesbd.ttf HiROM 
; TIMESBI.TTF %RETAIL%timesbi.ttf HiROM 
; TIMESI.TTF %RETAIL%timesi.ttf HiROM 
WINGDING.TTF %RETAIL%wingding.ttf HiROM 


; WinMine 
; Write 


; Arial 


; Arial Bold 
; Arial Bold Italic 
; Arial Italic 
* Courier New 
; Courier New Bold 
; Courier New Bold Italic 
: Courier New Italic 
; Symbol 
; Times New Roman 
; Times New Roman Bold 
; Times New Roman Bold Italic 
- Times New Roman Italic 
; WingDings 
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APPENDIX E 
EPLD EQUATIONS 


Included below are the equations for both the 85C090 and the 5AC312 EPLDs. See the RFA Schematic 
Diskette for disk-readable *.ADF and *.JED files. 


85C090 EPLD 


CN_SPC_A.ADF 
85C090 


OPTIONS: TURBO=ON 
PART: N85C090 % PLCC % 


% 


nh, 
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This EPLD provides the main control logic of the Resident Flash 
Array Evaluation board. The following is included: 


Flash Memory chip enables 3 
Modes Register chip enable (RS_CE/FLASH_CES) 
ROM Stub control logic 
74FCT623 Data Buffer Control 
74FCT373 Address Latches Gate control (HOLD#) 
WT, WTH#, and RD# generation 

~CN_REV _ A- 04/06/92 Initial release 


CN _SPC_A- 04/08/92 Reconfigured Flash Array to provide 8 Meg 
of Flash Disk and 4 Meg of Executable Memory. 


CN_SPC_B - 04/29/92 Update to allow byte writes. 
CN_REV_B - 06/01/92 Added generalize configuration scheme. 


% 


INPUTS: 

DL_OUT@2 % Delay line out (high edge sets PRDY f/f) % 
PM@4 % PI bus Memory or IO# % 
PCMD#@14 % PI bus Command % 
PSTART_DLY#@42 % Delayed PSTART# signal (used to create HOLD#) % 
Al4@S5 % PI/ISA bus Latched Addresses % 
A1S@19 

A16@20 

LA17@21 % PI/ISA bus Unlatched Addresses % 
LA18@26 

LA19@25 

LA20@27 

LA21@28 

LA22@29 

LA23@30 

MRDC#@3 % ISA bus Memory Read (All 16MByte) % 
VGACS#@13_  % VGA Chip Select % 
FLASHDCS#@12 % Flash Disk Chip Select % 

L PW@41 % PI bus PW/R# (latched) % 

EN PRDY@40 % Enable PRDY# driver % 
SA00@43 % Latched address bit 00 % 
SBHE_L#@37 %Latched System Byte High Enable % 
OUTPUTS: 


FLASH_CE0#@15 % Flash Memory Zone pairs Chip Selects % 
FLASH_CE1#@16 
FLASH_CE2#@35 
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FLASH_CE3#@34 
FLASH_CE4#@33 
FLASH_CE5#@32 


RS_CE@31 % ROM Stub Chip Select % 
RD#@6 % Read Strobe % 
WT_L#@10 % Write Strobe, Lower Byte % 
WT_U#@8 % Write Strobe, Upper Byte % 
WT@36 % Write Strobe (Active High for 74F623 enable) % 
HOLD#@7 % Hold Address Latches (close gate) % 
SA16@11 % HIGH for Sel_RS, else 3-S % 
DL_IN@38 % Delay line driver % 
PRDY#@9 % PI bus signal % 
PRDY@18 % D-type f/f % 
NETWORK: 

PM = INP(PM) 

nPCMD =INP(PCMD#) 

nPSTART_DLY = INP(PSTART_DLY#) 

Al4 = INP(A14) 

Al5 = INP(AI5) 

Al6 = INP(A16) 

LAI7 = INP(LA17) 


LAI8 = INP(LAI8) 
LAI9 = = INP(LA19) 
LA20. =INP(LA20) 
LA2]1. =INP(LA21) 
LA22. = INP(LA22) 
LA23. = INP(LA23) 


nMRDC = INP(MRDC4) 
- nVGACS- = INP(VGACS#) 

nFLASHDCS = INP(FLASHDCS#) 

L PW  =INP(L_PW) 

EN PRDY =INP(EN PRDY) 

DL OUT =INP(DL_OUT) 

SA00 = INP(SA00) 

nSBHE_L = INP(SBHE_L#) 


FLASH_CE0#,nFLASH_CEO 
FLASH_CE1#,nFLASH_CE1 
FLASH_CE2#,nFLASH_CE2 
FLASH_CE3#,nFLASH_CE3 
FLASH_CE4#,nFLASH_CE4 
FLASH_CES#,nFLASH_CES 


= COIF(_ FLASH_CEO0,VCC) 
= COIF(_ FLASH_CE1,VCC) 
= COIF(_ FLASH_CE2,VCC) 
= COIF(_ FLASH_CE3,VCC) 
= COIF( FLASH_CE4,VCC) 
= COIF(_ FLASH_CES5,VCC) 


RS_CE,RS_CEf = COIF(iRS_CE,VCC) 
RD# = CONF(_RD,VCC) 
WT_L# = CONF(_WT_L,VCC) 
WT_U# = CONF(_WT_U,VCC) 
WT = CONF(iWT,VCC) 
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HOLD# = CONF(_HOLD,VCC) 

DL_IN,DL_INf = COIF(iDL_IN, VCC) 

PRDY,PRDYf = RORF(VCC,DL_OUT,_DL_IN,GND,VCC) 
PRDY# = CONF(_ PRDY,EN_PRDY) 

SA16 = CONF(VCC,Rd_RS) 

EQUATIONS: 


% Internal Declarations % 


PCMD =nPCMD' 
PSTART_DLY = nPSTART_DLY'’; 
MRDC = nMRDC’ 

VGACS =nVGACS', 
FLASHDCS = nFLASHDCS'; 
SBHE_L =nSBHE_L’ 


FLASH CEO = nFLASH_CEO’; 
FLASH_CE1 =nFLASH_CE!'; 
FLASH CE2 = nFLASH_CE2’ 
FLASH_CE3 = nFLASH_CE3'; 
FLASH_CE4 = nFLASH_CE4'; 
FLASH CES =nFLASH CES’; 
_DLIN =DL_INf; 

-PRDY =PRDYf: 


Hold = PSTART_DLY 
+ PCMD 
+ MRDC; 


Open =/Hold; 
Closed =/Open; 


Sel FDM = FLASHDCS; % Flash Disk Memory (mem cycles only) % 
Sel XIP =/FLASHDCS * /VGACS * PM; % Execute-in-place Memory % 
% ROM Stub, 0C8000h through OCBFFEh % 
Sel RS = /FLASHDCS * /VGACS * /LA23 * /LA22 * /LA21 

2 * /LA20 * LA19 * LA18 * /LAI7 * /A16 * A115 */A14; 


Sel_ Modes = Sel_ FDM * LA23 * LA22 * LA21 * LA20 % Modes Reg % 
*LAI9 * LAI8 * LAI7 * Al6; 


Modes CE = RS_CEf* /FLASH_ CES; 
Rd RS =RS_CEf* FLASH CES; 


Yes = VCC; 
292097-21 
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No =GND; 


% Zone pairs 0 and | are unconditionally assigned to the Flash 
Disk. Zone pair 5 is unconditionally assigned to the Executable 
Memory. Zone pairs 2, 3, and 4 are assigned with the three 
equations below by selecting either Yes or No for the three 
Flash Disk assignments. Assignments must be in order, 3 can 
be assigned to the Flash Disk only if 2 is, and 4 can be assigned 
to the Flash Disk only if 2 and 3 is. Zone pairs not assigned 
to the Flash Disk are automatically assigned to Executable 
Memory. % 


% Demo Configuration 
Z2eqFD = No; 
Z3eqFD = No; 
ZAeqFD = No; 

% 


% Customer Configuration % 
Z2eqFD = Yes; 

Z3eqFD = Yes; 

ZAegFD = No; 


Z2eqXIP8 = /Z2eqFD; 


Z3eqXIP8 = /Z2eqXIP8 * /Z3eqFD; 
Z3eqXIPA = Z2eqXIP8 * /Z3eqFD; 


ZAeqXIP8 = /Z2eqXIP8 * /Z3eqXIP8 * /ZAeqFD, 
ZAeqXIPA = Z3eqXIP8 * /ZAeqFD; 
ZAeqXIPC = Z3eqXIPA * /ZAeqFD; 


ZS5eqXIP8 = /Z2eqXIP8 * /Z3eqXIP8 * /Z4eqXIP8; 
ZSeqXIPA = ZAeqXIP8; 
ZSeqXIPC = ZAeqXIPA; 
ZSeqXIPE = ZAeqXIPC; 


% Outputs % 


% Zone pairs 0 and | are unconditionally assigned to Flash Disk. % 
_FLASH_CE0'= Open * Sel_FDM * /LA23 * /LA22 * /LA21 
+ Closed * FLASH_CEO0; 


_FLASH_CEI'=Open * Sel_FDM * /LA23 * /LA22 * LA2I 
+ Closed * FLASH_CE1; | 


% Zone pairs 2, 3, and 4 are conditionally assigned to either 
Flash Disk or Execute-in-Place memory. XIP starts at 800000h 
to avoid conflict with ROM Stub. % 
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_FLASH_CE2'= Open * Sel FDM * /LA23 * LA22 * /LA21 * Z2eqFD 
+ Open *Sel_XIP * LA23 * /LA22 * /LA21 * Z2eqXIP8 
+ Closed * FLASH_CE2; 


_FLASH_CE3'= Open * Sel_FDM * /LA23 * LA22 * LA21 * Z3eqFD 
+ Open *Sel_XIP * LA23 * /LA22 * /LA21 * Z3eqXIP8 
+ Open * Sel_XIP * LA23 * /LA22 * LA21 * Z3eqXIPA 
+ Closed * FLASH_CE3; 


_FLASH_CE4'= Open * Sel_FDM * LA23 * /LA22 */LA21 * Z4eqFD 
+ Open *Sel_XIP * LA23 * /LA22 * /LA21 * ZA4eqXIP8 
+ Open * Sel XIP * LA23 * /LA22 * LA21 * Z4eqXIPA 
+ Open * Sel XIP * LA23 * LA22 */LA21 * Z4eqXIPC 
+ Closed * FLASH_CE4; 


% Zone pair 5 is unconditionally assigned to Execute-in-Place. 
Zone pair 5 is also enabled if Rom Stub is selected. % 


_FLASH_CES'= Open * Sel_XIP * LA23 * /LA22 * /LA21 * ZSeqXIP8 
+Open *Sel_XIP * LA23 * /LA22 * LA21 * ZSeqXIPA 
+ Open * Sel_XIP * LA23 * LA22 * /LA21 * ZSeqXIPC 
+ Open *Sel_XIP * LA23 * LA22 * LA21 * ZSeqXIPE 
+ Open *Sel_RS 
+ Closed * FLASH_CES; 


% RS_CE forces Flash Addresses 15 through 20 high. This, along 
with the activation of FLASH_CES#, cause ROM Stub accesses to 
| go to the upper 16 KBytes of Zone pair 5. % 
iRS CE =Open *Sel_RS 
+ Open * Sel_Modes 
+ Closed * RS_CEf,; 


_RD' =PCMD*FLASH CEO */L PW 

+ PCMD * FLASH CEI * /L_PW 

+ PCMD * FLASH_CE2 */L_PW 

+ PCMD * FLASH_CE3 * /L_PW 

+ PCMD * FLASH_CE4 * /L_PW 
+ PCMD * FLASH_CES5 */L_PW 

+ PCMD * Modes CE */L_PW 

+ MRDC * Rd_RS; 


_WT_U' =PCMD * FLASH CEO * L_PW * SBHE_L 
+ PCMD * FLASH_CEl * L_PW * SBHE _L 
+ PCMD * FLASH_CE2* L PW * SBHE L 
+ PCMD * FLASH_CE3 * L_ PW * SBHE L 
+ PCMD * FLASH_CE4* L_ PW * SBHE _L 
+ PCMD * FLASH_CES * L_PW* SBHE L 


+ PCMD * FLASH_CES * L_PW*RS_CEf% RS_CE->SBHE_L 3-S % 


+ PCMD * Modes CE * L_PW * SBHE_L; 
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_WT_L'’ =PCMD * FLASH CEO * L PW */SA00 
+ PCMD * FLASH _CEl * L_PW */SA00 
+ PCMD * FLASH_CE2 * L_ PW */SA00 
+ PCMD * FLASH CE3 * L_PW */SA00 
+ PCMD * FLASH_CE4 * L_PW */SA00 
+ PCMD * FLASH CES * L_PW */SA00 
+ PCMD * Modes CE * L_PW */SAO0; 


iWT | =PCMD* FLASH CEO* L_ PW 
+ PCMD * FLASH CE] * L_PW 
+ PCMD * FLASH_CE2* L_PW 
+ PCMD * FLASH_CE3 * L_PW 
+ PCMD * FLASH_CE4 * L_PW 
+ PCMD * FLASH_CES5 * L_ PW 
+ PCMD * Modes CE * L PW: 


_HOLD' = Hold; 


iDL_IN = PCMD * FLASH_CE0 
+ PCMD * FLASH _CEl 
+ PCMD * FLASH_CE2 
+ PCMD * FLASH_CE3 
+ PCMD * FLASH_CE4 
+ PCMD * FLASH_CES5 
+ PCMD * Modes _ CE; 


END$ 
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OPTIONS: TURBO = OFF 
PART: N5AC312 % PLCC % 


% 
This EPLD contains logic for the following: 
Flash Array VPP control 
FDM and XIP Power Down control 
Flash Disk Memory READY Interrupt control 
MD_REV A- 04/08/92 Initial release 
MD_REV B - 04/29/92 MODES CE now a function for FLASH_CES and 
RS_CE, rather than separate. This is to : 
save pins on the other EPLD. : 


% 
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INPUTS: 

WT#@2 % Write Strobe % 

RD#@4 % Read Strobe % 

SA01@9 % Buffered/Latched Address bit 01 % 
SA02@10 % Buffered/Latched Address bit 02 % 
RSTDRV@16 % ISA bus Reset Driver % 
ALL_RDY@27 % All Flash ICs assigned to Flash Disk are RDY % 
SMOUT4@12 %+SLOCAL ON when this is high % 
FLASH_CES#@6 

RS_CE@8 % ROM Stub Chip Select % 
OUTPUTS: 

% Output pins % 


EN_FLASH_VPP@22 % Pwr Cntrl Reg bit 00; Enable Flash Array VPP % 
PWR_UP@26 % Pwr Cntrl Reg /bit 03 % 

PWRD#@3 % Power control signal to entire Flash Array % 

INTR@13 % Intr Cntrl Reg bit 00; Flash Disk RDY Intr % 

SD00@17 % Internal Data Bus % 

SD01@18 

SD02@20 

SD03@21 

UNUSED23@23 

UNUSED24@24 


% Buried Macrocells % 


CLR_INTRf % Clear Interrupt flip-flop % 
EN_INTR£f = % Modes Reg bit 02; Enable Flash Disk RDY Intr % 


NETWORK: 


nWT = INP(WT#) 
nRD = = INP(RD#) 

SAO1 = INP(SAO1) 

SA02. = INP(SA02) 

RSTDRV_ = INP(RSTDRV) 

ALL _RDY =INP(ALL_RDY) 
SMOUT4 = INP(SMOUT4) 
INTR_CLK =CLKB(ALL_RDY) 
nFLASH_CES = INP(FLASH_CES#) 
RS CE =INP(RS CE) 


SD00,SDOOf = COIF(iSD00,CHIP_RD) 
SD01,SD01f = COIF(iSD01,CHIP_RD) 
SD02,SD02f = COIF(iSD02,CHIP_RD) 
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SD03,SD03f = COIF(iSD03,CHIP_RD) 
EN_FLASH_VPP,EN_FLASH_VPPf= RORF(iEN_FLASH_VPP,nWT,RSTDRV,GND, VCC) 
PWR_UP,PWR_UPf = RORF(iPWR_UP,nWT,GND,RSTDRV, VCC) 
PPWRD# = CONF(_PWRD,VCC) 

EN_INTRf£ = NORF(iEN_INTR,nWT,RSTDRV,GND) 
INTR,INTRE = RORF(VCC,INTR_CLK,CLR_INTR£,GND, VCC) 
CLR_INTRf = NOCF(iCLR_INTR) 

UNUSED23 = CONF(GND, VCC) 

UNUSED24 = CONF(GND, VCC) 

EQUATIONS: 

% Internal declarations % 

RD = nRD' 

WT =nWT; 


FLASH_CES =nFLASH_CES', 

Modes CE =RS _CE* /FLASH_ CES: 
Sel_Pwr_Reg = Modes CE * /SA02 * /SAO1; 
Sel_Intr_Reg = Modes CE * /SA02 * SAOI; 
Sel_Cir_Intr = Modes CE * SA02 * SAO1; 
CHIP_RD =RD * Modes CE; 
FDM_Busy =/ALL_RDY; 

% Outputs and buried registers % 


iSDOO = Sel_Pwr_Reg * EN FLASH_VPPf 
+ Sel_Intr_ Reg * EN INTRf; 


iSD01 = Sel Pwr_Reg * GND 
+ Sel_Intr_Reg * INTRf; 


iSD02 = Sel_Pwr_Reg * GND 
+ Sel_Intr_ Reg * FDM_Busy, 


iSD03 = Sel_ Pwr_Reg * /PWR_UPf 
+ Sel_Intr_Reg * GND; 


iEN_FLASH_VPP = Sel_Pwr_Reg * SDOOf 
+ /Sel_ Pwr_Reg * EN_FLASH_VPPf; 


iPWR_UP- = Sel_Pwr Reg * /SDO3f 
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+ SMOUT4; 


iEN INTR = Sel_Intr Reg * SDOOf 
+ /Sel_Intr Reg * EN_INTRE 


iCLR_INTR =RSTDRV 
+ /EN_INTRE 
+ WT * Sel_Cir_Intr, 


END$ 
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1.0 INTRODUCTION 


The Intel 28FOO8SA FlashFile™M Memory is today’s 
optimum solution for high density solid state storage. 
Flash memory, exemplified by the 28FOO8SA, is an en- 
abling technology for today’s powerful system designs 
that are higher performance, more compact, lighter, 
more rugged and have longer battery life. 


Features of the 28FOO8SA include: 


e High-Density Symmetrically Blocked Architecture: 
— Sixteen 64-Kbyte Blocks 


e Extended Cycling Capability 
— 100,000 Block Erase Cycles 
— 1.6 Million Block Erase Cycles per Chip 


e Automated Byte Write and Block Erase 
— Command User Interface 
— Status Register 


e System Performance Enhancements 
— RY/BY# Status Output 
— Erase Suspend Capability 


Deep Powerdown Mode 

— 0.20 pA Icc Typical 

@ Very High Performance Read 
— 85 ns Maximum Access Time 


¢ SRAM-Compatible Write Interface 


e Hardware Data Protection Features 
— Erase/Write Lockout during Power Transitions 


e Industry Standard Packaging 
— 40 Lead TSOP, 44 Lead PSOP 


e ETOX III Nonvolatile Flash Memory Technology 
— 12V Byte Write/Block Erase 


The 28FO08SA’s automation is a significant enhance- 
ment to the manual algorithms of first-generation flash 
memory devices. System software and hardware de- 
signs that fully understand and exploit this automation 
will greatly benefit from its versatility and capabilities. 
The concepts presented in this document are applicable 
to such designs. 


This application note discusses in-depth operation of 
the 28FOO8SA FlashFile memory Write State Machine 
and internal algorithms, emphasizing how they inter- 
face to system hardware and software. The 28FOO8SA 
datasheet (order number 290429) is a valuable reference 
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document, providing in-depth device technical specifi- 
cations, package pinouts and timing waveforms. Com- 
panion application note AP-359, “28FO08SA Hardware 
Interfacing” (order number 292094) describes supply 
voltage derivation and filtering, control input/output 
implementation, high density layout and high speed de- 
sign techniques, as well as providing example system 
interfaces to common microprocessor buses. AP-360, 
“28FOO8SA Software Drivers” (order number 292095) 
provides example ASM-86 and “‘C” routines for con- 
trolling the 28FOO8SA. AP-359 and AP-360 should be 
reviewed in conjunction with this application note and 
the 28FOO8SA datasheet for a complete understanding 
of this device. 


2.0 AUTOMATION AND 
ALGORITHMS 


Figure 1 shows a block diagram of the 28FOO8SA and 
its internal contents. Although a main subject of this 
application note is software interface to read and alter 
memory contents, it is useful to begin with an overview 
of the 28FOO8SA hardware subsections that are directly 
manipulated by the system. In particular, this applica- 
tion note will first discuss the Write State Machine 
(WSM) and Command User Interface/Status Register, 
and then explain the software routines that control this 
hardware. 


2.1 28F008SA Automation and the 
Write State Machine 


When the system microprocessor reads flash memory 
data from the 28FOO8SA, it uses control lines CE# and 
OE#, along with address inputs, to select a byte of data 
directly from the memory cell array. However, the sys- 
tem does not directly access the array when it writes to 
the 28FOO8SA; instead it writes to the Command User 
Interface, whose register contents are interpreted and 
translated into WSM actions. The WSM can be 
thought of as a dedicated “processor”, along with com- 
panion clock-generation circuitry, integrated into the 
flash memory. After receiving proper commands or 
command sequences, it controls byte write and block 
erase algorithms internally. The status of the WSM is 
not invisible to the system; the WSM interfaces to the 
outside world through a full-featured Status Register 
and dedicated RY/BY # (Ready/Busy #) output. Au- 
tomation has significant benefits, some of which are 
more obvious than others. 
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Figure 1. 28FO008SA Block Diagram 


The WSM architecture dramatically simplifies the pro- 
gram and erase algorithms of first-generation flash 
memory devices. Hardware/software timers, erase pre- 
programming, byte-by-byte verification and margining, 
pulse repetition and limited microprocessor multitask- 
ing capability throughout data update have been elimi- 
nated, replaced by a simple two-command write for 
both block erase and byte write. The 28FOO8SA WSM 
halts itself when its internal algorithms are complete, 
and can alert the system to this completion by a hard- 
ware interrupt (using RY/BY #) or via software poll- 
ing of the 28FOO8SA Status Register. 


Internal automation frees the system to execute higher- 
priority tasks while a 28FOO8SA is being block erased 
or byte written, and inherent in this capability is the 
most powerful advantage of the WSM. Operating sys- 
tems prioritize file operations in the following order: 


@ Read 
e Write 
e Erase 


When an array of 28FOO8SA components is used as 
solid-state storage (in a memory card, integrated in a 
flash-based “hard drive” form factor or resident on the 
system motherboard), system software can initiate 
slower block erase (0.3 sec minimum) of one or several 


28FOO8SAs and, by not being “tied’”’ to the erase algo- 
rithm, execute higher. priority reads (85 ns minimum) 
or writes (6 ws minimum) of other 28FOO8SAs as oper- 
ating system requests dictate. Additionally, erase sus- 
pend/resume capability allows data retrieval from a 
28FO08SA currently being block erased, again enabling 


“read” as the highest priority task. Block erase as a 


background task is discussed in Section 2.6 of this doc- 
ument. 


Command User Interface 


Table 2 shows the various command sequences that are 
accepted and interpreted by the 28FOO08SA Command 
User Interface and WSM. Writes to the CUI enable 
reading of device data and intelligent identifiers, read- 
ing and clearing of the Status Register, and commence- 
ment of internal byte write, block erase and erase sus- 
pend/resume algorithms. The CUI itself does not occu- 
py a specifically addressable memory location, and con- 
tains a latch used to store the command and address/ 
data information needed to execute the command. 
Erase Setup and Erase Confirm commands require both 
appropriate command data and an address within the 
block to be erased. The Byte Write Setup command 
requires appropriate command data and the address of 
the location to be written, while the Byte Write com- 
mand consists of the data to be written and its address 
location. 


3-197 


~ AP-364 | ; = intel. 


Table 1. Status Register Definitions 
[wsms | ess | es | Bws | vpps| R | R | FR 
7 6 5 4 3 2 1 0 


SR.7 = WRITE STATE MACHINE STATUS NOTES: 
1 = Ready RY/BY# or the Write State Machine Status bit must 
0 = Busy first be checked to determine byte write or block erase 
completion, before the Byte Write or Erase Status bits 
SR.6 = ERASE SUSPEND STATUS are checked for success. 


1 = Erase Suspended If the Byte Write AND Erase Status bits are set to “1’’s 

0 = Erase in Progress/Completed during a block erase attempt, an improper command 
sequence was entered. Attempt the operation again. 

SR.5 = ERASE STATUS If Vpp low status is detected, the Status Register must 

1 = Error in Block Erasure be cleared before another byte write or block erase op- 


eration is attempted. 
The Vpp Status bit, unlike an A/D converter, does not 
SR.4 = BYTE WRITE STATUS provide continuous indication of Vpp level. The WSM 
interrogates the Vpp level only after the byte write or 
block erase command sequences have been entered 
and informs the system if Vpp has not been switched 
a on. The Vpp Status bit is not guaranteed to report ac- 
oe curate feedback between Vpp, and Vppy. 


0 = Successful Block Write 


1 = Error in Byte Write 
0 = Successful Byte Write 


— 
I 


Vpp Low Detect; Operation Abort 


SR.2-SR.0 = RESERVED FOR FUTURE ENHANCEMENTS 
These bits are reserved for future use and should be masked out when polling the Status Register. 


Table 2. Command Definitions 


First Bus Cycle 
Notes 
Erase Setup/Erase Confirm 


Operation | Address | Data 
ease te 
Erase Suspend/Erase Resume 


Write FFH 
Byte Write Setup/Write Part 
Alternate Byte Write Setup/Write ne ee 


NOTES: 
1. IA = Identifier Address: OOH for manufacturer code, 01H for device code. 
BA = Address within the block being erased. 
WA = Address of memory location to be written. 
2. SRD = Data read from Status Register. See Table 4 for a description of the Status Register bits. 
WD = Data to be written at location WA. Data is latched on the rising edge of WE. 
iD = Data read from intelligent identifiers. 
3. Following the intelligent identifier command, two read operations access manufacturer and device codes. 
4. Either 40H or 10H are recognized by the WSM as the Byte Write Setup command. 
5. Commands other than those shown above are reserved by Intel for future device implementations and should not be 
used. 


Second Bus Cycie 
Cycles 


ead 
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Status Register 


Table 1 shows the 28FOO8SA Status Register and de- 
fines its various bits. Like the Command User Inter- 
face, it does not occupy a specific memory location 
within the device. It functions as an output of the 
WSM, informing the system when internal byte write 
or block erase algorithms have completed, if these algo- 
rithms completed successfully, and whether the 
28FOO8SA is currently in Erase Suspend mode. Bit 7 
(Write State Machine Status) is replicated in the device 
RY/BY# hardware output. The default state of the 
upper 5 bits of the Status Register after powerup and 
return from deep powerdown mode is 10000 (binary). 


A separate Clear Status Register command allows re- 
initialization of Status Register data after analysis. The 
Status Register is not cleared until this command is 
written to the 28FOO8SA. 


Bits 5 and 4 of the Status Register, if set by the WSM 
via a byte write or block erase attempt, do not block 
subsequent attempts (they need not be cleared before 
another byte write/block erase command sequence is 
written to the device). However, if the WSM detects a 
“low Vpp” condition and subsequently sets bit 3 of the 
Status Register, the Status Register MUST be cleared 
- before another algorithm command sequence will be 
recognized by the 28FOO8SA. 


It is important to note that the Vpp Status bit of the 
Status Register DOES NOT act like an always-func- 
tional A/D converter; its normal state, even with Vpp 
below 6.5V, is ‘0’. The WSM only analyzes the Vpp 
level after a byte write or block erase command se- 
quence has been written to the device, and if it detects 
that Vpp is “low” it will cancel the impending byte 
write or block erase operation and set the Vpp Status 
bit to “1”. Therefore, the Vpp Status bit cannot be used 
by the system as an indication of proper Vpp level, be- 
fore a byte write or block erase sequence is initiated. 
The system should instead insert an appropriate soft- 
ware delay between turning on Vpp and writing an ini- 
tial command sequence, or use external hardware as a 
Vpp feedback mechanism. 
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2.2 Byte Write Algorithm 


Figure 2 provides a graphical representation of the 
28FO08SA byte write algorithm. As can be seen, this 
consists solely of a two-command write sequence, fol- 
lowed by a periodic poll of the device RY/BY # output 
or Status Register. The 28FOO8SA automatically out- 
puts Status Register data when read after the two-com- 
mand byte write sequence (see Section 2.5). Byte write 
typically completes in 9 ps. | 


The byte write algorithm requires high voltage Vppy 
(12V +5%) on the device Vpp input until internal al- 
gorithm completion is reported by the WSM. If byte 
write is attempted while Vpp = Vppyz (<6.5V), the 
Vpp Status bit of the Status Register will be set to “1’’, 
and array data will not be altered. Byte write attempts 
while Vppy < Vpp < Vppy produce spurious results 
and should not be attempted. 


The Status Register will only report errors for “‘1’’s that 
do not write to “0”’s during a byte write attempt. Era- 
sure (see Section 2.3) is the method used to change data 
*0”’s to “1’’s using flash technology. If the system soft- 
ware attempts to write “1”’s to a byte at bit locations 
already at value “0”, no Status Register error will be 
reported for those specific bits. 


It is often desired to write multiple bytes of data at one 
time to memory. Since the Status Register is only 
cleared after the Clear Status Register command is 
written to the 28FOO8SA, a string of bytes can be se- 
quentially written to the device before the “full status 
check procedure” examines Status Register bits other 
than SR.7. 


Byte write abort occurs when the 28FOO8SA RP # (Re- 
set/Powerdown) input drops to Vj; (deep powerdown 
mode is entered), or Vpp drops to Vppy,.. Although the 
WSM ‘is halted in either case, byte data is partially writ- 
ten at the location where aborted. A repeat byte write 
sequence after system integrity is restored will complete 
the desired operation, or data can be initialized to a 
known value of “FF” thru block erasure. 
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Bus Command Comments 
Operation 


Write 40H (10H), Byte Write | Data = 40H (10H) 
Byte Address Setup | Address = Byte to be written 


Write Byte Byte Write | Data to be written 
Address/Data Address = Byte to be written 


Standby/ 


Read Check RY/BY # 


Von = Ready, Vo_ = Busy 
or 
Full Status Read Status Register 
Check if Desired Check SR.7 
1 = Ready, 0 = Busy 


Byte Write Toggle OE # or CE# to update 
status Register 
292099-2 Repeat for subsequent bytes 


Full status check can be done after each byte or after a 
sequence of bytes 


Write FFH after the last byte write operation to reset the 
device to Read Array Mode 


FULL STATUS CHECK PROCEDURE 


Bus 
Optional CPU may already have read 
Read (See Above) Read Status Register data in WSM 
Ready polling above 


Standby Check SR.3 
1 = Vpp Low Detect 


Standby Check SR.4 


| 1 = Byte Write Error 
Error SR.3 MUST be cleared, if set during a byte write attempt, 


before further attempts are allowed by the Write State 
Machine 


Byte Write ; . 
SR.4 is only cleared by the Clear Status Register Command, 


in cases where multiple bytes are written before full status is 
292099-3 checked 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 2. Automated Byte Write Flowchart 
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2.3 Block Erase Algorithm 


Figure 3 provides a graphical representation of the 
28FOO8SA block erase algorithm, similar in its two- 
command write sequence to the byte write algorithm 
discussed earlier. Both the Erase Setup and Erase Con- 
firm commands must be accompanied by an address 
within the desired block to be erased to FFH. The 
28FOO8SA automatically outputs Status Register data 
when read after the two-command block erase sequence 
(see Section 2.5). Block erase typically completes in 
1.6 sec. 


Again similar to byte write, the block erase algorithm 


requires high voltage Vppy (12V +5%) on the device 
Vpp input until internal algorithm completion is re- 
ported by the WSM. If block erase is attempted while 
Vpp = Vppr (<6.5V), the Vpp Status bit of the Status 
Register will be set to “1’’, and array data will not be 
altered. Block erase attempts while Vpp, < Vpp < 
VppH produce spurious results and should not be at- 
tempted. 


If write of the Erase Setup command is followed by 
write of any other command but Erase Confirm, the 
WSM will decode this as an illegal sequence. It will not 
attempt to erase the specified block, and will report 
error back to the system by setting both the Erase 
Status and Byte Write Status bits of the Status Register 
to “1”. Since the Status Register is only cleared after 
the Clear Status Register command is written to the 
28FOO8SA, a string of blocks within a 28FOO8SA can 
be sequentially erased before the “full status check pro- 
cedure” examines Status Register bits other than SR.7. 
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Block erase abort occurs when the 28FOO8SA RP# 
(Reset/Powerdown) input drops to Vy; (deep power- 
down mode is entered) or Vpp drops to Vpp,. A repeat 
block erase sequence after system integrity is restored 
will complete the desired operation. 


2.4 Erase Suspend/Resume 
Algorithm 


Figure 4 gives a software flowchart for implementing 
erase suspend/resume using the 28FOO8SA. As men- 
tioned in Section 2.1, operating systems prioritize data 
reads highest, and consequently the 28FOO8SA_ has 
been designed with read as its highest performance 
function. Erase suspend allows system software to post- 
pone WSM-controlled block erase if the system re- 
quests read of data from a different block of the same 
device. Although any block of the 28FOO8SA can be 
read, the block being erased when suspended will con- 
tain unknown data. 


The 28FO08SA is suspended by writing the Erase Sus- 
pend command (BOH) to it while the WSM is executing 
an erase algorithm. The WSM will halt block erase, set 
bits 7 and 6 of the Status Register to “1” and transition 
RY/BY# to Von, after which time system software 
can read data from either the array or Status Register. 
Issuing the Erase Resume command (DOH) signals the 
WSM to resume block erase. 


Vpp must remain at Vppy throughout the erase sus- 
pend interval, even when reading from the flash memo- 
ry array. The 28FOO8SA will detect a Vpp transition to 
Vppi while suspended, and report this error via Status 
Register bit 3 (set to “1”) after the Erase Resume com- 
mand is written to it. 
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Bus 


Erase Data = 20H 
Setup Address = Within block to be 
erased 


Write Erase Data = DOH 
Confirm | Address = Within block to be 


‘ ‘ ; erased 
5 halle oe Standby/ Check RY/BY # 
Read VoH = Ready, Vo_ = Busy 


or 


Read Status Register 
Full Status Check SR.7 
Check if Desired 1 = Ready, 0 = Busy 
Toggle OE # or CE# to 


update Status Register 
Completed Repeat for subsequent blocks 


292099-4 
Full status check can be done after each block or after a 


sequence of blocks 


Write FFH after the last block erase operation to reset 
the device to Read Array Mode 


Bus 
foperaion |command| Comments 


Optional CPU may already have read 
Read (See Above) Read Status Register data in WSM 


Ready polling above 


Standby Check SR.3 
1 = Vpp Low Detect 


Error Both 1 = Command Sequence 


Error 


Standby Check SR.5 
Error 1 = Block Erase Error 


SR.3 MUST be cleared, if set during a block erase attempt, 
before further attempts are allowed by the Write State 


Block Erase Machine 
Successful 


292099-5 SR.5 is only cleared by the Clear Status Register Command, 
in cases where multiple blocks are erased before full status 
is checked 


If error is detected, clear the Status Register before 
attempting retry or other error recovery 


Figure 3. Automated Block Erase Flowchart 
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Write BOH 
Write 70H 
Read Status 
Register 


Write FFH 


Done 
Reading? 


YES 


Write DOH 


Erase Has 
Completed 
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Bus 


Erase 
Suspend 


Write Read 
Status Register 


Standby 
Read 


- Standby 


Read Array 


Erase Resume 


Figure 4. Erase Suspend/Resume Flowchart 


Data = BOH 


Data = 70H 


Check RY/BY # 
VoH = Ready, Vo_ = Busy 
or Read Status Register 


Check SR.7 

1 = Ready, 0 = Busy 
Toggle OE # or CE# to 
Update Status Register 


Check SR.6 
1 = Suspended 


Data = FFH 


Read array data from block 
other than that being erased. 


Data = DOH 
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Since the WSM is driven by its own oscillator, internal 
to the 28FOO8SA, it operates asynchronously to the sys- 
tem CPU and its clock. Therefore, the possibility exists 
that the WSM could complete erase, returning to 
“ready”, between when the system reads “busy” from 
the Status Register and writes the Erase Suspend com- 
mand. Analyzing both the WSM Status and Erase Sus- 
pend Status bits of the Status Register, as shown in the 
flowchart, will alert the system to such an occurrence. 


2.5 Write State Machine Current/Next 
State Overview 


Byte write and block erase automation equate to tre- 
mendous power and capability in system implementa- 
tions of the 28FOO8SA, if fully exploited. An in-depth 
understanding of the WSM, its states and its responses 
to inputs, will assist the software engineer in developing 
optimized driver routines for flash memory-based file 
storage and other high-performance applications. Table 
3 lists all possible WSM “current states”, command 
inputs and resultant “next states’’. 


Non-shaded boxes highlight those state transitions 
which will most commonly occur when reading from 
and modifying 28FOO8SA contents, and these tran- 
sitions should be understood in most depth. Shaded 
boxes, on the other hand, represent lesser-used or non- 
sensical transitions, such as improper erase command 
sequences. 


Before reading the 28FOO8SA, if the current WSM 
mode is not known (if, for example, an interrupt service 
routine has potentially interacted with the device), first 
write the desired output command (i.e. Read Status 
Register, Read Array or Intelligent Identifier). This en- 
sures that the 28FO08SA will be in a known state when 
read and will output expected data. 
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Read Array 


The 28FO08SA automatically defaults to Read Array 
mode when powered up, or when it returns from Deep 
Powerdown mode. As the name implies, the 28FOO8SA 
outputs array data when read in Read Array mode. 
Read Array is also the default mode after the Clear 
Status Register command is written in most other 
modes. 


Byte Write Setup 


The 28F008SA transitions to Byte Write Setup mode 
after it receives the Byte Write Setup command. If the 
28FOO8SA is read in Byte Write Setup mode, it outputs 
Status Register data. 


Byte Write 


After the 28FOO8SA is placed in Byte Write Setup 
mode, the next address/data combination written to it 
transitions the WSM to Byte Write mode, where the 
“Byte Write Command” is latched as desired data to 
write to the array at the specified address location. Im- 
mediately, the WSM examines Vpp, and if it detects an 
invalid level, it halts with Vpp error indication in the 
Status Register (bit 3 = “1’’). Bit 7 of the Status Regis- 
ter is “0”, and the RY/BY # output is driven to Vo, 
while the WSM is executing the internal byte write al- 
gorithm in Byte Write mode. The 28FO08SA automati- 
cally outputs Status Register data when in Byte Write 
mode. 


Erase Setup 


The 28FO08SA transitions to Erase Setup mode after it 
receives the Erase Setup command. If the 28FO08SA is 
read in Erase Setup mode, it outputs Status Register 
data. 


Current |RY/BY # oe 

State | Status Write 
Setup 
(10/40H) 


Read 
Array 


Byte Write 
Setup 


Byte Write 
(Not 
Complete) 


Byte Write 
(Complete) 


Erase 
Command 
Error 


Erase ———C 
(Not  f5 Suspend 
Complete) _. _ __ te Status 


Suspend 
to Status 


Erase 
Suspend ' Suspend) © ot 
to Array toAreyi ro atus 


Sa 


Read 
Status 
. : 


Read ; _. Read | Read | 
seaalaeea! _ | Status | Array | 


NOTE: 
1. State transitions labeled “Reserved” are set aside by Intel Corporation for potential future device implementations. Com- 


mand sequences to access these states should not be attempted. 
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Erase 


After the 28FOO8SA is placed in Erase Setup mode, 
write of the Erase Confirm command transitions the 
WSM to Erase mode, where the specified address is 
decoded into one of 16 blocks to be erased. Immediate- 
ly, the WSM examines Vpp, and if it detects an invalid 
level, it halts with Vpp error indication in the Status 
Register (bit 3 = “1’’). Bit 7 of the Status Register is 
“0”, and the RY/BY # output is driven to Vo;, while 
the WSM is executing the internal block erase algo- 
rithm in Erase mode. The 28FOO8SA automatically 
outputs Status Register data when in Erase mode. 


Erase Command Error 


This is the other possible transition mode after Erase 
Setup, and occurs when an invalid command (anything 
but Erase Confirm/Resume) is written to the 
28FOO8SA as the second in the two-command block 
erase sequence. In this mode, the WSM does not at- 
tempt a block erase, and it returns an error indication 
to the system by setting both bits 4 and 5 of the Status 
Register to “1”. The 28FOO8SA automatically outputs 
Status Register data when in Erase Command Error 
mode. 


Erase Suspend to Status/Array 


While the WSM is busy executing an internal block 
erase algorithm, it can be placed in erase suspend by 
writing the Erase Suspend command. After receiving 
and decoding this command, the WSM suspends block 
erase, drives the RY/BY# output to Voy, sets bits 6 
and 7 of the Status Register to “1” and transitions to 
“Erase Suspend to Status” mode. The 28FO08SA auto- 
matically outputs Status Register data when in “Erase 
Suspend to Status” mode. 


The only valid command other than Read Status and 
Erase Resume at this time is Read Array, which tran- 
sitions the WSM to “Erase Suspend to Array” mode. 
As the name implies, the 28FOO8SA outputs array data, 
not Status Register contents, in this mode. While in 
both Erase Suspend modes, Vpp must remain at Vppy 
for erase to complete successfully when resumed. 


Writing the Erase Resume (same as Erase Confirm) 
command to the 28FOO8SA transitions the WSM out of 
Erase Suspend and back to Erase. In conjunction with 
this, the WSM returns RY/BY # to Vo, and resets bits 
6 and 7 of the WSM to “0”. 
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As the name implies, the 28FO08SA automatically out- 
puts Status Register contents when read in Read Status 
mode. If system software writes the Clear Status com- 
mand at this point, the WSM resets the Status Register 
to its default value and transitions to Read Array 
mode. 


Read Status 


Read Identifier 


The 28FOO8SA outputs its manufacturer identifier of 
89H when read from address 00000H when in Read 
Identifier mode. Similarly, a read from address 00001H 
returns the device identifier A2H. Using this informa- 
tion, the system can automatically match the device 
with its proper block erase and byte write algorithms. 
Reads from addresses other than O0000H and 00001H 
are not supported by Intel, and consistent results of 
such reads are not documented, guaranteed or recom- 
mended. 


2.6 Block Erase as a Background 
Task 


As mentioned earlier, the internal WSM block erase 
algorithm typically takes 1.6 seconds to complete. 
Proper implementation of block erase from a hardware 
and software standpoint, however, can mask this delay, 
by taking advantage of the 28FOO8SA’s internal auto- 
mation and full-featured system interface. Execution of 
block erase as a background task, with higher priority 
read and write functions in the foreground, is the key. 


The recommended scenario includes an “intelligent” 
operating system routine which can keep track of 
“busy” devices in the 28FOO8SA array. After initiating 
block erase on these components, the operating system 
is free to concentrate on reads and writes, or any other 
pending requests that demand its attention. The 
28FOO8SA RY/BY# output alerts the system when 
block erase completes, and the operating system acts on 
this completion in the resulting interrupt service rou- 
tine. 


Hardware interrupt via the RY/BY # output is a rec- 
ommended technique for block erase. However, this 
method should be evaluated closely for alerting the sys- 
tem to byte write completion. The WSM typically com- 
pletes a byte write attempt in 9 ys, a much shorter time 
than that consumed in many CPU interrupt latencies. 
In such cases, software polling of the 28FOO8SA Status 
Register to detect WSM “ready”, versus hardware in- 
terrupt, will result in highest byte write performance. 
Reference AP-359, “28FOO8SA Hardware Interfacing”, 
for circuit implementations that not only combine 
RY/BY#s into a common INT, but also allow 
RY/BY # masking if desired. 


intel R AP-364 


ADDITIONAL INFORMATION 


Order 
Number 
28F008SA Datasheet 290429 
28F008SA-L Datasheet 290435 
AP-359 “28FO08SA Hardware 292094 
Interfacing”’ 
AP-360 ‘“28F008SA Software 292095 
Drivers” 
ER-27 “The Intel 28FOO8SA Flash 294011 
Memory” 
ER-28 “ETOX-III Flash Memory 294012 
Technology” 


REVISION HISTORY 


| Number _ Description 
roe PWD # pin renamed RP # to match JEDEC standards. ao 
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1.0 PURPOSE 


The 28F016SA is the second member of Intel’s 
FlashFile™M memory family. Its architecture evolved 
from that of the 28FO08SA, Intel’s first generation 
FlashFile memory device. The 28FO16SA retains the 
standard 28FOO8SA’s versatile capabilities and adds a 
Command Superset architecture which insures compat- 
ibility with the basic command-set. 


This application note shows how to upgrade an existing 
28FO08SA-based design to the new 28FO16SA memory 
device. Upgrades may require software modifications 
depending on the desired system functionality and 
straightforward hardware modifications to accommo- 
date the new pinout. 


2.0 SIMILARITIES AND DIFFERENCES 
BETWEEN THE 28F016SA AND 
THE 28F008SA 


The 28F016SA memory is 100% command and algo- 


rithm, backward-compatible with the 28FOO8SA. It is 
defined as a Superset device which brings additional 
capabilities to system designs. Additional pins on the 
28FO16SA are added to define a user-selectable 8- or 
16-bit wide memory, add on-chip write protection and 
multiple chip select signals. Note that you do not have 
to use the advanced features if you are performing a 
simple upgrade to the 28FO16SA. 


Before starting on your design upgrade, obtain the fol- 


lowing specifications and application notes from Intel 
Corporation Literature Sales, 1 (800) 548-4725. 
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Order # 
28F008SA Data Sheet 290429 
28F016SA Data Sheet 290489 
28F016SA User’s Manual 297372 
28F008SA Software Drivers 292095 
28F016SA Software Drivers 292126 


2.1 Pinout Differences 


Whereas the 28FOO8SA is 8-bit wide (40Ld-TSOP 
package), the 28FO16SA is a high performance 16-bit 
wide flash file memory offering a user-configurable bus 
width (56Ld-TSOP package). Hence an additional 8 
I/O pins are on the 28FO16SA. Furthermore, the im- 
plementation of additional features such as Write Pro- 
tect and Block Locking and user-selectable 3.3V and 
5V operation require the definition of control pins for 
these functions. Finally, the optimization of the 
28F016SA’s architecture to achieve very high write 
performance resulted in a different pinout configura- 
tion from the 28FOO8SA. 


Both device pinouts preserve the locations of I/O pins 
on the right-hand side and the sequence of pin func- 
tions of the 56Ld-TSOP package. However, it is still 
required to relay out an existing PCB design in order to 
accommodate the 16-Mbit chips. Table 1 lists all pin 
names and their numbers, highlighting all the changes. 
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Table 1. 28F008SA, 28F016SA Pin Comparison Chart 
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CE# 
pee 
RY/BY # 


WE # 


Vpp 


NOTES: 

1. Highest Order Address 

2. Dual CEx# 

3. Formerly Called PWD # 

4. Open Drain for 28F016SA 
5. x8/x16 Selection 

6. Selects Supply Voltage 
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2.1.1 HARDWARE COMPATIBLE 
CONFIGURATION 


The following is an example which shows the state of 
all pins when operating in a 28FOO8SA-compatible 
mode: 


WP# = Vcc (Write Protect feature disabled) 
CEjp# = CE,;# (Chip Enable) 
A20 = GND or Vcc (selects upper/lower 1 MB) 


Address to Select 
Between Upper and 
Lower 1 Mbyte 
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(3/5 # = GND (SV operation) or Vcc (3.3V oper- 
| ation) 

Vcc =5.0V or 3.3V. 

BYTE# = GND (8-bit mode) 

RY/BY# = Level Mode (set for default) with an ex- 


ternal pull-up resistor 


NOTE: 
The 28FO08SA has a CMOS driven RY/BY # output 
for interrupt capability. 


28F016SA 


292124-1 


Figure 1. 28F016SA Configured as a 28FO08SA-Compatible Memory 
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2.2 Compatible Command-Set 


Byte Write 40H, 10H 
Single Block Erase 20H 
Erase Suspend to Read BOH 


Read Array FFH 
Read CSR 70H 
Clear CSR 50H 


Read Intelligent IDs 90H 


Table 2. 28FOO8SA-Compatible Commands 


| Read Compatible Status Register 
Clear Status Register 


ADDRESS DATA 


AA = Array Address AD = Array Data 
BA = Block Address CSR = Compatible Status Register 
|A = Identifier Address CSRD = CSRData 
WA = Write Address GSR = Global Status Register 
X = Don’t Care BSR = Block Status Register 
ID = Identifier Data 
WD = Write Data 


NOTES: 

1. Following the Intelligent Identifier command, two Read operations access the manufacturer and device signature codes. 
2. The CSR is automatically available after device enters Data Write, Erase, or Suspend operations. 

3. Clears CSR.3, CSR.4 and CSR.5. Also clears GSR.5 and all BSR.5 and BSR.2 bits. See Status register definitions in th 
28F016SA data sheet. . 
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2.3 Technology Comparison 


Both the 28FO16SA and the 28FOO8SA are manufac- 
tured on Intel’s Flash ETOX process technology. This 
technology is optimized for random access flash memo- 
ry products with the highest read/write performance 
and lowest power consumption. The ETOX flash tech- 
nology achieves very high reliability and quality. 


2.4 Available Speeds 


The 28F016SA designed on a 0.6 wm ETOX IV pro- 
cess, achieves faster speeds than the 28FOO8SA manu- 
factured on 0.8 »m ETOX III process. Intel offers the 
28FOO8SA in 5V-read version with speeds at 85/90 ns 
and 120 ns. The 28F016SA on the other hand is offered 
with a dual 3.3V and 5V read capability with speeds of 
(70/80 ns, 100 ns) and (120 ns, 150 ns) at 5V and 3.3V 
respectively. Note that both devices are offered at faster 
speeds (85 ns and 70 ns) under reduced loading condi- 
tions. Please consult the data sheets referenced in this 
application note. 


2.5 Available Packages 


The 28F016SA comes only in a 56Ld-Thin Small Out- 
line Package (TSOP) optimized for its user-selectable 
x8/x16 memory architecture. The 28FOO8SA is offered 
in 2 packages, which are the 40Ld-TSOP (both stan- 
dard and reverse pinout) and the 44Ld-Plastic Small 
Outline Package (PSOP). 


2.6 Operating Modes 


The 28F0O16SA behaves in the same manner as the 
28FOO8SA. If a compatible command is written to the 
device, the Compatible Status Register contents are au- 
tomatically put on the data bus. With the block locking 
disabled (WP # = high), the 28F016SA is identical to 
the 28FOO8SA, regardless of any lock-bit settings which 
define the lock state of a given block. The Command 
User Interface (CUI), Write State Machine (WSM) and 
Compatible Status Register (CSR) units function simi- 
larly on both devices. 


The 28F016SA however, allows the user to issue multi- 
ple commands successively by watching the Queue bit 
(GSR.3 or BSR.3), a feature which improves perform- 
ance, as described in the 28FO16SA user’s manual. 
Consult the 28F0O16SA data sheet and 28FO16SA user’s 
manual for detail operation. 
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2.7 AC Compatibility 


The 28FO16SA specifies the output Load circuit as an 
equivalent transmission line model which reflects the 
timing delays more accurately. The same diode/resistor 
circuit combination found in the 28FOO8SA data sheet 
also applies to the 28FO16SA. 


Address and Data are latched on the rising edge of 
WE# for both devices. All AC timing specifications 
are similar except for the differences noted in the data 
sheets. The 28FO16SA has additional write timings de- 
scribing the on-chip page buffers which do not exist on 
the 28FOO8SA. 


2.8 DC Compatibility 


Whereas the 28FO0O8SA only operates at 5V Vcc and 
the 28FOO8SA-L only operates at 3.3V Vcc, the 
28F016SA operates at both 3.3V and 5V Vcc supply 
voltages. In 5V mode of operation, the two devices are 
similar in terms of input/output level specifications. 
Consult the data sheets for differences in current con- 
sumption. 


2.9 Power Considerations 


In addition to the active, standby and deep power-down 
modes which exist on the 28FOO8SA, the 28FO16SA 
has additional current modes useful in power manage- 
ment applications. 


The two modes are: 


Automatic Power Saving feature which is activated 
whenever the device addresses are not switching which 
is equivalent to a static mode of operation on the chip is 
accessed by a slowed clock. In this state, the chip typi- 
cally draws less than 1 mA of total current. 


The second low current mode of operation is enabled 
through command control, using the Sleep command. 
A Sleep command written to the device will put the 
chip in the lowest current state (deep power-down lev- 
el) after all active operations have been processed. The 
device retains the value of its status registers while in 
sleep mode. 


Note that the AC and DC specifications mentioned 
here are valid at the time this application note was writ- 
ten. Please reference the device data sheets for the latest 
up-to-date specifications. 
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3.0 HARDWARE DESIGN 
CONSIDERATIONS 


If you are considering a density upgrade to the 
28FO16SA, careful attention to certain areas must be 
followed. This section is not intended to cover all po- 
tential issues related to system design, but rather as a 
guideline in designing an upgrade to the 28FO16SA. 


3.2 Hardware Decision Flowchart 


RE-LAYOUT PCB 
ADD EXTRA ADDRESS LINE 
A20 


16-Mbit in 8-Mbit 
COMPATIBLE 
MODE 


IS RY/BY# USED? 


USE EXTERNAL PULL-UP RESISTOR 
CONFIGURE RY/BY# TO DEFAULT 
LEVEL MODE 
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3.1 Hardware Upgradability 


The following flowchart summarizes the logical steps a 
system designer must go through to complete a density 
upgrade. This simple upgradability procedure allows 
the 28F016SA-based system to achieve quicker time-to- 
market while incorporating future expandability to take 
advantage of the Superset features of the 28FO16SA. 


16-Mbit in 
SUPERSET MODE 


BLOCK LOCKING? 
BUS WIDTH? 


RY /BY# MODE? 


292124-2 
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4.0 SOFTWARE DESIGN AND 
UPGRADABILITY 
CONSIDERATIONS 


In order to do a software upgrade to the 28F016SA, the 
software designer must pay attention to a few key areas. 
They can be grouped as follows: 


Device Intelligent Identifler = AOH (versus A2H for 
28FO08SA) 

Compatible Superset Commands 

Compatible Status Register Checks only 

Number of Erase Blocks 


4.1 Software Decision Flowchart 


16-Mbit in 8-Mbit 
COMPATIBLE 
MODE 


RECOGNIZE 
16-Mbit JEDEC DEVICE ID? 


COMPATIBLE COMMANDS 
& 
COMPATIBLE STATUS 
REGISTER ONLY CHECKS 


MODIFY # OF BLOCKS 
BASED ON DEVICE ID 
USE EQUIVALENT 
DEVICE DRIVERS 
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Device Drivers for the 28FOO8SA and the 28FO16SA 
are provided in application notes AP-360 and AP-377 
respectively. 


Software drivers written for the 28FOO8SA need to rec- 
ognize the new device ID and change the memory size 
boundaries in order to work on a ih clea sie sys- 
tem design. | 

Note that the 28FO16SA can be treated as two 8-Mbit 
memory devices in a single package. The highest order 
address pin Ajo is used to switch between the upper 
and the lower 1 Mbyte flash array. By preserving the 
same basic software driver code, an upgrade to the 
28FO16SA enables the quickest time-to-market. 


RE-WRITE SOFTWARE DEVICE 
DRIVERS 


16-Mbit in 
SUPERSET MODE 


FLASH MEMORY CHIP 
NOT RECOGNIZED 
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5.0 COMPATIBLE SOFTWARE ALGORITHM FLOWCHARTS 


pus Command Comments 
Operation 
Write Word/Byte D = 40H or 10H 
Write A=xX 
D = WD 
A= WA 


Write Toggle CE #, CE; #, or 
Data/Address OE # to update CSRD. 
A=xX , 


Check CSR.7 

1 = WSM Ready 

0 = WSM Busy 
Repeat for subsequent Word/Byte Writes. 


CSR Full Status Check can be done after each Word/Byte 
Write, or after a sequence of Word/Byte Writes. 


Write FFH after the last operation to reset device to Read 
Array Mode. 


See Command Bus definitions in the 28F016SA User’s 
Manual for description of codes. 
1 


CSR Full Status 


Check If Desired 


Operation Complete 
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CSR FULL STATUS CHECK PROCEDURE 


Read CSRD 
(See Above) Bus Command Comments 
Operation 


1 
Standby Check CSR.4 
1 = Data Write Unsuccessful 
Data Write 
Successful Standby 3 Check CSR.3 


0 = Data Write Successful 
1 = Vpp Low Detect 
0 = Vpp OK 

CSR.3/4 SHOULD be cleared, if set, before further attempts 


are initiated. 
Vpp Low Detect 


Clear CSRD 
Retry/Error Recovery 
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Figure 2. Word/Byte Writes 
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Bus 
Operation 
Write Block Erase D = 20H 
_A=xX 
i ace ieeah Confirm D = DOH 
A= BA 


Q = CSRD 
Toggle CE #, CE, #, or 
Write DOH and OE # to update CSRD. 
Block Address 3 
Standby Ngee) Check CSR.7 


1 = WSM Ready 
Repeat for subsequent Block Erasures. 


0 = WSM Busy 
Suspend Erase CSR Full Status Check can be done after each Block Erase, 
NO Loop or after a sequence of Block Erasures. 


Read Compatible 
Status Register 


Write FFH after the last operation to reset device to Read 
Array Mode. 


See Command Bus definitions in the 28F016SA User’s 
Manual for description of codes. 


Suspend YES 
Erase 


CSR Full Status 
Check If Desired 


URAL 


Operation Complete 
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CSR FULL STATUS CHECK PROCEDURE 
Read CSRD Bus 
oe noe) Loperaion| Command | Comments 


Standby Check CSR.5 
1 = Erase Error 
0 = Erase Successful 
Erase Successful Standby Check CSR.3 
1 = Vpp Low Detect 


al 


0 = Vpp OK 


Standby Check CSR.4, 5 
Both set to 1 = Command 
Sequence Error 
‘pp aw Detect CSR.3/4/5 SHOULD be cleared, if set, before further attempts 
are initiated. 


of) 


Command Sequence 
Error 


Clear CSRD 
Retry/Error Recovery 
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Figure 3. Block Erase 
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me Command Comments 
Operation 
_ Erase D = BOH 
Suspend A=xX 
ide ih Read Q = CSRD 
Toggle CEp #, CE; #, or OE# 
to update CSRD. 
‘ A=xX 
Read Comparable Standby Check CSR.7 
Status Register 1 = WSM Ready 
0 = WSM Busy 
Standby Check CSR.6 
1 = Erase Suspended 
0 = Erase Completed ' 
Read Array D = FFH 
A=xX 
Read Q=AD 
Read must be from block other 
0 than the one suspended. 
Erase Completed Erase D = DOH 
Resume A=xX 
See Command Bus definitions in the 28FO16SA User’s 
Manual for description of codes. 


Write FFH 


Read 
Array Data 


=) 
°o 
= | 
@® 


Reading 


YES 


Write DOH Write FFH 


Read 


Erase Resumed Array Data 
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Figure 4. Erase Suspend to Read Array 
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6.0 SUMMARY grade and to point out the key issues that the hardware 
and software designers must analyze during this pro- 

This application note summarizes the upgrade consid- cess. 

erations and compatibility areas between the 28FO16SA 

and the 28FOO8SA. It is merely intended as a simple Consult the referenced documentation for a complete 

guideline to achieve a density and/or performance up- understanding of compatibility and device capabilities. 
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INTRODUCTION 


ABOUT THE CODE 


This application note provides example software code 
for word writing, block erasing, and otherwise control- 
ling Intel’s 28FO16SA 16 Mbit symmetrically blocked 
FlashFile™ memory. Two programming languages are 
provided: high-level “C” for broad platform support, 
and more optimized ASM86 assembly. In many cases, 
the driver routines can be inserted “‘as is” into the main 
body of code being developed by the system software 
engineer. Extensive comments are included in each rou- 
tine to facilitate adapting the code to specific applica- 
tions. 


The internal automation of the 28FO16SA makes soft- 


ware timing loops unnecessary and results in platform- 
independent code. The following example code is de- 
signed to be executed in any type of memory and with 
all processor clock rates. “‘C’’ code can be used with 
many microprocessors and microcontrollers, while 
ASM86 assembly code provides a solution optimized 
for Intel microprocessors and embedded processors. 


The 28F016SA, like the 28FOO8SA, is divided into 64 
Kbyte blocks. Since the GSR and BSR are defined rela- 
tive to the nearest preceding block beginning address, I 
often refer to this “block base” address in the com- 
ments. 


Assumptions: 


e Pointers (in C) or EDI offsets (in ASM86) are 4 
bytes long, providing a flat addressing space over 
the entire 28FO16SA device. This implies the use of 
386 or higher machines. If the code is to be run on a 
machine with a smaller address space, the code must 
be modified to include some sort of “windowing” 
scheme which maps segments of flash into system 
memory. The Intel 82365 is commonly used for this 
purpose. 

e “Ints” are 16-bit and “longs” 32-bit in C. 


e There exists a function which can toggle an individ- 
ual 28FO16SA pin, given the pin number. 


© The C code can access a function which derives the 
corresponding block base address from any given 
address. 


¢ BYTE# pin on the device determines whether ad- 
dressing refers to words or bytes. I assume word 
writes/reads to a single device. The code should be 
valid, however, for pairs 28F016SAs in byte mode. 
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@ 28F016SA commands can be written to any address 
in the block or device to be affected by that com- 
mand. Note that a word-long command written to 
the last byte in a block will overlap into the first byte 
of the next block. 


Both the C and ASM86 code in this document contain 
the following routines, in this order: 


compatible__block__erase (compatible with 28FOO8SA) 
compatible__suspend__to_read (compatible with 
28FOO8SA) 

compatible__byte__write (compatible with 28FO08SA) 
ESR__block__erase 
ESR__status__check__after__erase 
ESR__status__check__after__write 
ESR__suspend__to__read 

ESR__word__write 

erase__all__unlocked__blocks 

lock__block 

status__upload 

pagebuffer__write__to__flash 
sequential__pagebuffer__load 
single__pagebuffer__load 

two__byte__write 

write__during__erase 


ABOUT THE 28F016SA 


Companion product datasheets for the 28FO16SA 
should be reviewed in conjunction with this application 
note for a complete understanding of the device. 


The example code makes extensive use of bit-masking 
when interpreting the status registers. As a quick re- 
view, note that any bit in a register can be tested by 
bitwise ANDing the register with the appropriate pow- 
er of two. Since all of the bits other than the one being 
tested are masked out, testing the resulting byte for 
truth is the same as testing the desired bit for truth. For 
example, if a register contains 01001010, the test for bit 
3 would be ANDing the register with 00001000, or hex 
8, and testing the result for truth: 


Binary Hex 

01001010 4A Register 
& 00001000 & 08 Mask for bit 3 
= 00001000 = 08 Result 


In this case the result byte is true, indicating that bit 3 
in the register was a 1. 
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The meanings of the individual bits of these registers 
are presented here for reference. Note that there are 
two status register spaces, both of which are distinct 
from the flash memory array address space. In the CSR 
space, the CSR is mapped to every address. In the ESR 
space, the GSR is mapped two words above the base of 
each 64 Kbyte block, ic. to addresses 2, 8002H, 
10002H, etc. (in word mode), while each BSR is simi- 
larly mapped one word above the base of each 64 Kbyte 
block to locations 1, 8001H, 10001H, etc. (in word 
mode), each BSR reflecting the status of its own block. 


CSR.7 | Write State Machine 1= ready 
Status O= busy 


CSR.6 | Erase-suspend Status = erase suspended 


erase in 
CSR.5 | Erase Status 


progress/ 
CSR.4 | Data-write Status 
operation 


completed 
CSR.3 | Vpp Status 
occurred 
CSR.2 | Reserved for future 
use 
CSR.1 | Reserved for future 
use 


CSR.0O | Reserved for future 
use 


error in block 
erase 
successful block 
erase 


= error in data write 
0O= successful data 
write 


Vpp low detect/ 
operation aborted 
O= Vpp OK when 
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Operation-suspend 
Status 


1= operation 
suspended 

O= operation in 
progress/ 
completed 


Device Operation 


1= operation 
unsuccessful 

O= operation | 
successful or 
running 


Device Sleep Status 1= device in sleep 
O= device not in 


sleep 


Queue Status 1= queue full 
O= queue available 


Page Buffer 1= one/two page 
Availability buffers available 
O= no page buffers 
available 


Page Buffer Status 1= selected page 
buffer ready 
O= selected page 


buffer busy 


Page Buffer Select 
Status 


1= page buffer 1 
selected 

O= page buffer 0 
selected 


BSR.7 | Block Status 1= ready 
O= busy 


BSR.6 | Block-lock Status 1= block unlocked 
for write/erase 

Block Operation 

Status 


0= block locked to 
write/erase 
BSR.4 | Block Operation Abort 
Status 


neg Queue Status 
Vpp Status 


Reserved for future 
use 

BSR.O | Reserved for future 
use 


1= error in block 
operation 

O= successful block 

operation 


1= block operation 
aborted 

0= block operation 

not aborted 


1= device queue full 
O= device queue 
available 


1= Vpp low detected 
O= Vpp OK when 
operation 
occurred 


a ; 
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28F016SA Commands 28F016SA Performance-Enhancement 

| Commands 

The 28F016SA command set is a superset of the 

28FOO8SA command set, giving existing 28FO08SA OC page buffer write to flash 

code the ability to run on the 28FO16SA with minimal 71 read GSR and BSRs (i.e. the ESR) 

modifications. 


72 page buffer swap 


74 single load to page buffer 


28F008SA-Compatible Commands 75 read page buffer 


00 invalid/reserved TT lock block 
20 single block erase 80 abort 
40 word/byte write 96,01 RY/BY# enable to level-mode 
50 clear status registers 96,02 RY/BY# pulse on write 
70 read CSR 96,03 RY/BY# pulse on erase 
90 read ID codes 96,04 RY/BY# pin disable 
BO erase suspend | 97 upload BSRs with lock bit 
DO confirm/resume 99 upload device information 
FF read flash array A7 erase all unlocked blocks 
EO sequential load to page buffer 
FO sleep 


FB two-byte write 
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“C” DRIVERS 


J PFPERES TEESE SS SHEL SE ELSES EELS SLE HEE CELE SES RR SAGES ELT FS ESEMSELSL SS SLA SSPE S SS f 


/* Copyright Intel Corporation, 1993 */ 
/* Example C Routines for the 28F0O16SA Flash memory component * f 
/* Patrick Killelea, Intel Corporation 7s 
/* Revision 1.0, 25 June 1993 */ 
/* *] 
/* NOTE: BYTE# pin on the device determines whether addressing * / 
/* refers to words or bytes. I assume word mode. * / 
/* NOTE: A 28FO16SA command can be written to any address in the * / 
/* block or device to be affected by that command. ae 


HOECES ESET ETHERS S PERS ES EESESE SESE SERSRSES SESS SELES SES KE SESE ESOS EERSTE ASS AS SS 
#include <stdio.h> 
void set_pin(int pin, int level) 


/* set_pin is an implementation-dependent function which sets a */ 
/* given pin on the standard 28F0O16SA pinout HIGH = 1 or LOW = 0. */ 


int *base(int*address) 


/* base is an implementation-dependent function which takes an * / 
/* address in the flash array and returns a pointer to the base * 
/* of that 64 Kbyte block. * 
} ' 
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int compatible_block_erase (int*address) 


/* This procedure erases a 64 Kbyte block on the 28F016SA. 
/* It also works with a pair of 28F0O08SAs. 

int CSR; 

/* CSR variable is used to return contents of CSR register. 


*address = 0X2020; 

/* Single Block Erase command 

*address = OXDODO; 

/* Confirm command 

while(!(OX0080 & ¥address)) 

° Poll CSR until CSK.7 = 1 .(WSM “ieeae' 


2 Erase may be Suspended here to write to a different block. 
/* At this point, CSR.7 is 1, indicating WSM is not busy. 

/* Note that we are still reading from CSR by default. 

CSR = *address; 

/* Save CSR before clearing it. 

*address = 0X5050; 

/* Clear Status Registers command 

return(CSR) ; 

/* Return CSR to be checked for status of operation. 

} 
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int compatible_byte_write(int-address, int data) 


/* This procedure writes a byte to the 28FO16SA. 

/* It also works with the 28F008SA. 

int. CSR; 

/* CSR variable is used to return contents of CSR register. 


*address = 0X1010; 

/* Word Write command 

*address = data; 

/* Actual data write to flash address. 
while(!(OX0080 & *address) ); 

/* Poll CSR until CSR.7 = 1 (WSM ready) 


CSR = *address; 

/* Save CSR before clearing it. 

*address = 0X5050; 

/* Clear Status Registers command 

return(CSR) ; 

° Return CSR to be checked for status of operation. 
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int compatible_suspend_to_read(int*read_address, int*erase_address, int*result) 


/* This procedure suspends an erase operation to do a read. 
/* It also works with a pair of 28F008SAs. 

int CSR; 

/* CSR variable is used to return contents of CSR register. 


/* Assume erase is underway in block beginning at erase_address. 
*erase_address = OXBOBO; 
/* Erase Suspend command 
while(!(OX0080 & *erase_address) ) ; 
/* Poll CSR until CSR.7 = 1 (WSM ready) 
*erase_address = OXFFFF; 
/* Read Flash Array command 
*result = *read_address; 
/* Do the actual read. Any number of reads can be done here. 
if (OX0040 & *erase_address) 
/* If CSR.6 = 1 (erase incomplete) 
*erase_address = OXDODO; 
/* Erase Resume command 
CSR = *erase_address; 
/* Save CSR before clearing it. 
*erase_address = 0X5050; 
/* Clear Status Registers command 
return(CSR) ; 
/* Return CSR to be checked for status of operation. 
j 


e § 
“7 


“e 
“7 
4 
*/ 
*/ 
*F 
*/ 
*/ 
*/ 
*/ 
bt 
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int device_information_upload(int*address) 


/*This procedure uploads the device revision number to the variable GSR_DSR. */ 


int GSR_DSR: 


/*DSR variable is used to return device revision status. */ 
int *block_base = base(address) ; */ 
/*Find pointer to base of 32K word block. fi 


*address = 0X7171; 


/*Read Extended Status Registers command 7 */ 
while (QX0008 & *(block_base + 2)); 

/*Poll GSR until GSR.3 = 0 (queue available). */ 
while (!(OX0080 & *(block_base + 2))) ; 

/*Poll GSR until GSR.7 = 1 (WSM available). */ 
*address = 0X9999; 

/*Device information Upload command * 
*address = OXDODO; 

/*Confirmation command J 
*address = 0X7171; 

/*Read Extended Status Registers command a J 
while (!(OX0080 & *(block_base + 2))); | 

/*Poll GSR until GSR.7 = 1 (WSM not busy) * 
*address = 0X7272; 

/*Swap page buffer to bring buffer with status information to top. =f 
*address = 0X7575; 

/*Read Page Buffer command */ 
GSR_DSR = (*(block_base + 3) & OXOOFF) ; 

/*Put device revision code in bottom byte of return value. * 
/*Note that device revision code was read from word 3 in page buffer. */ 
*address = 0X7171; 

/*Read Extended Status Registers command * f 
GSR_DSR += (*(block_base + 2) & OXFFOO) ; 

/*Put GSR in top byte of return value. *f 
/*User should check GSR for operation success * 
*address = 0X5050; 

/*Clear Status Registers command * 


return(GSR_DSR) ; 
} 
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int ESR_block_erase(int*erase_address) 


. This procedure erases a block on the 28F016SA. *f 
int ESR; 

/* ESR variable is used to return contents of GSR and BSR. * 
int*block_base = base(erase_address) ; 

/* Find address of base of block being erased. * / 
*erase_address = 0X7171; 

/* Read Extended Status Registers command * / 
while (OX0008 & *(block_base + 1));3 

/* Poll BSR until BSR.3 of erase_address = 0 (queue available). * 
/* BSR is 1 word above base of target block in ESR space. * / 
*erase_address = 0X2020; 

/* Single Block Erase command */ 
*erase_address = OXDODO; 

/* Confirm command */ 
*erase_address = 0X7171; 

/* Read Extended Status Registers command */ 
while (!(O0X0080 & *(block_base + 1)));3 

/* Poll BSR until BSR.7 of target erase_address = 1 (block ready). a 
ESR = (*(block_base + 2) & OXFFOO) + (*(block_base + 1) & OXOOFF) ; 

/* Put GSR in top byte and BSR in bottom byte of return value. * f 
*erase_address = 0X5050; 

/* Clear Status Registers command */ 


return(ESR) ; 
} 
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int ESR _suspend_to_read (int*address,int*result) 
/* This procedure suspends an erase on the 28FO16SA. 
{ 


/* Address is assumed to point to location to be read. 

/* result is used to hold read value until procedure is complete. 
int ESR; 

/* ESR variable is used to return contents of GSR and BSR. 
int*block_base = base(address) ; 


*address = 0X7171; 

/* Read Extended Status Registers command 

while (!(O0X0080 & *(block_base + 1))); 

/* Poll BSR until BSR.7 of target address = 1 (block ready). 

/* BSR is 1 word above base of target block in ESR space. 

*address = OXBOBO; 

/* Operation Suspend command 

*address = 0X7171; 

/* Read Extended Status Registers command 

while (!(0X0080 & *(block_base + 2))); 

/* Poll GSR until GSR.7 = 1 (WSM ready). 

*address = OXFFFF; 

/* Read Flash Array command 

*result = *address; 

/* Read the data. 

if (OX0040 & *(block_base + 2)) 

/* If GSR.6 indicates an operation was suspended on this device, 
*address = OXDODO; 

/* then resume the operation. 


ESR = (*(block_base + 2) & OXFFOO) + (*(block_base + 1) & OXOOFF); 


/* Put GSR in top byte and BSR in bottom byte of return value. 
*address = 0X5050; 

/* Clear Status Registers command 

Rene 
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int ESR.word_write(int*write_address, int data) 


/* This procedure writes a word to the 28F016SA. */ 
{ 

int ESR; 

/* ESR variable is used to return contents of GSR and BSR. */ 


int*block_base = base(write_address) ; 


*write_address = 0X7171; F 


/* Read Extended Status Registers command * 
while (OX0008 & *(block_base + 1)); 

/* Poll BSR until BSR.S of target address = 0 (queue available). a J 
/* BSR is 1 word above base of target block in status reg space. Wf 
*write_address = 0X1010; 

/* Write word command * 
*write_address = data; 

/* Write actual data. , ‘ad 
*write_address = 0X7171; 

/* Read Extended Status Registers command “7 
‘while (!(O0X0080 & *(block_base + 1))) ; 

/* Poll BSR until BSR.7 of target address = 1 (block ready). of 
ESR = (*(block_base + 2) & OXFFOO) + (*(block_base + 1) & OXOOFF) ; 

/* Put GSR in top byte and BSR in bottom byte of return value. * 
*write_address = 0X5050; 

/* Clear Status Registers command */ 


return(ESR) ; 
} 
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int erase_all_unlocked_blocks(int*device_address, long *failure_list) 
/* This procedure erases all the unlocked blocks on a 28FO16SA. 
{ 


int GSR; 

/* Return value will contain GSR in both top and bottom byte. 
/* 32 bit long pointed to by failure_list is used to return map 
/* of block failures, each bit representing one block's status. 
/* device_address points to base of chip. 

int block; 

/* block is used to hold block count for loop through blocks. 
long power = 1; 


*Pailure_list = 0; 

/* Initialize all 32 bits of failure list long to 0. 
*device_address = 0X7171; 

/* Read Extended Status Registers 

while (OX0008 & *(device_address + 1)); 

/* Poll BSR until BSR.S of target address = 0 (queue available). 
*device_address = OXA7A7; 

/* Full-chip erase command 

*device_address = OXDODO; 

/* Confirm command 

*device_address = 0X7171; 

/* Read Extended Status Registers command 

while (!(OX0080 & *(device_address + 2))); 

/* Poll GSR until GSR.7 = 1 (WSM ready) 


for (block = 0; block < OX0020; block++) 


/* Go through blocks, looking at each BSR.5 for operation failure 
/* and setting appropriate bit in long pointed to by failure list. 
if (OX0020 & *(device_address + block *0X8000 + 1) ) 
/* Multiply block by 32K words to get to the base of each block. 
*failure_list + = power; 
/* If the block failed, set that bit in the failure list. 
power *= 2; | 
/* Increment to next power of two to access next bit. 


GSR = *(device_address + 2); 

/* Put GSR in both bytes of return value. 
*device_address = 0X5050; 

/* Clear Status Registers command 

Sepak ree: 
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int lock_block(int*lock_address) | 


. This procedure locks a block on the 28FO16SA. */ 
int ESR; 

/* ESR variable is used to return contents of GSK and BSR. */ 
#define WPB 56 

/* Write Protect pin (active low) is pin number 56 on standard * 
/* pinout of 28F016SA. */ 
#define VPP 15 

/* Vpp pin is pin number 15 on standard pinout of 28FO16SA. “J 


#define HIGH l 
#define LOW 0 


int*block_base = base(lock_address) ; | 
/* Find pointer to base of block being locked. sat 


*lock_address = 0X7171; . 

/* Read Extended Status Registers command */ 
while (OX0008 & *(block_base + 2)); 

/* Poll GSR until GSR.3 = 0 (queue available). a 5 
set_pin(WPB, HIGH) ; 

/* Disable write protection by setting WPB high. */ 
set_pin(VPP, HIGH) ; 

/* Enable Vpp, wait for ramp if necessary in this system. */ 
*lock_address = 0X7777; 

/* Lock Block command ye 
*lock_address = OXDODO; 

/* Confirmation command */ 
*lock_address = 0X7171; 

/* Read Extended Status Registers command at 
while (!(O0X0080 & *(block_base + 2))) ; 

/* GSR is 2 words above 0; poll GSR until GSR.7 = 1 (WSM ready). * / 
ESR = (*(block_base + 2) & OXFFOO) + (*(block_base + 1) & OXOOFF) ; 

/* Put GSR in top byte and BSR in bottom byte of return value. * 
*lock_address = 0X5050; 

/* Clear Status Registers command */ 


return(ESR) ; 
} 
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int statusS_upload(int*address) 
/* This procedure uploads status information into the ESR from non-volatile */ 


* Status bits. *7 
int. ESR’: 

/* ESR variable is used to return contents of GSR and BSR. */ 
int*block_base = base(address) ; 

/* Find pointer to base of 32K word block. al 
*address = 0X7171; 

/* Read Extended Status Registers command al 
while (OX0008 & *(block_base + 2)); 

/* Poll GSR until GSR.3 = 1 (queue available). aif 
*address = 0X9797; 

/* Lock=status Upload command */ 
*address = OXDODO; 

/* Confirmation command a i 
*address = 0X7171; 

/* Read Extended Status Registers command * 
while (!(OX0080 & *(block_base + 2))); 

/* Poll GSR until GSR.7 = 1 (WSM not busy) * 
ESR = (*(block_base + 2) & OXFFOO) + (*(block_base + 1) & OXOOFF) ; 

/* Put GSR in top byte and BSR in bottom byte of return value. * 
*address = 0X5050; 

/* Clear Status Registers command * 


return (ESR) ; 
j 
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int pagebuffer_write_to_flash(int*address, int byte_count) 


a This procedure writes from page buffer to flash. */ 
/* This routine assumes page buffer is already loaded. * 
/* Address is where in flash array to begin writing. * 
/* Low byte of byte_count must be 256 or fewer, high must be 0. * f 
/* High byte exists for future Page Buffer expandability. * 
int ESR; 

/* ESR variable is used to return contents of GSR and BSR. a 
int*block_base = base(address) ; 

/* Find pointer to base of block to be written. */ 
*address = 0X7171; 

/* Read Extended Status Registers command * 
while (OX0008 & *(block_base + 1)) ; 

/* Poll BSR until BSR.3 of target address = 0 (queue available). ad 4 
*address = OXOCOC; 

/* Page Buffer Write to Flash command * 
*address = byte_count; 

/* Only AO valid here; low or high byte loaded depending on AO. * 
*address = byte_count; 

/* AO internally complemented; alternate byte loads; write starts * 
*address = 0X7171; 

/* Read Extended Status Registers command * 
while (!(O0X0080 & *(block_base + 1)).) 3 

/* Poll BSR until BSR.7 of target address = 1 (block ready). * f 
ESR = (*(block_base + 2) & OXFFOO) + (*(block_base + 1) & OXOOFF) ; 

/* Put GSR in top byte and BSR in bottom byte of return value. */ 
*address = 0X5050; | 

/* Clear Status Registers command */ 


return(ESR) ; 
j 
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void sequential_pagebuffer_load(int*device_address, char*start_address, 
int word_count, int* data) 


/* This procedure loads a multiple bytes to a page buffer. * 
{ 

/* Low byte of word_count must be 128 or fewer, high must be 0. * 
/* High byte exists for future Page Buffer expandability. “7 
char counter; 

/* counter is used to keep track of bytes written. */ 


*device_address = 0X7171; 


/* Read Extended Status Registers command */ 
while (!(OX0004 & *(device_address + 2))); 

/* Poll GSR until GSR.2 = 1 (page buffer available). */ 
*device_address = OXEOEO; 

/* Sequential Page Buffer Load command */ 
*Start_address = word _count; 

/* Loads high or low byte of count register, depending on AO * / 
*start_address = word_count; 

/* Automatically loads alternate byte of count register */ 


for (counter = 0; counter < word count; counter++) 

*(start_address + counter) = data[counter]; 
/* Loop through data, writing to page buffer. * / 
/* This routine does not affect status registers. * / 
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void single_pagebuffer_load(int*device_address, char*address, int data) 


¥ This procedure loads a single byte or word to a page buffer. * 
*device_address = 0X7171; 

/* Read Extended Status Registers command +) 
while (!(O0X0004 & *(device_address + 2))); 

/* Poll GSR until GSR.2 = 1 (page buffer available) * 
*device_address = 0X7474; 

/* Single Load to Page Buffer command * 
*address = data; 

/* Actual write to page buffer td 
/* This routine does not affect status registers. * 


int two_byte_write(int*address, char data_low, char data_high) 


/* This routine is used when BYTE# is low, i.e. the 28F0O16SA * 
/* is in byte mode, to emulate a word write. */ 
int ESR; 

/* ESR variable is used to return contents of GSR and BSR. * 
int*block_base = base(address) ; 

/* Find pointer to base of block. * 
*address = 0X7171; 

/* Read Extended Status Registers command * 
while (OX0008 & *(block_base + 1)) ; 

/* Poll BSR until BSR.3S of target address = 0 (queue available). * 
*address = OXFBFB; 

/* Two=-byte Write command * 
*address = data_low; 

/* Load one byte of data register; AO = 0 loads low byte, Al high * 
*address = data_high; 

/* 28FO16SA automatically loads alternate byte of data register al 
/* Write is initiated. Now we poll for successful completion. * f 
*address = 0X7171; 

/* Read Extended Status Registers command */ 
while (!(O0X0080 & *(block_base + 1))) ; 

/* Poll BSR until BSR.7 of target address = 1 (block ready). * / 
/* BSR is 1 word above base of target block in status reg Space. * 


ESR = (*(block_base + 2) & OXFFOO) + (*(block_base + 1) & OXOOFF) ; 


/* Put GSR in top byte and BSR in bottom byte of return value. * 
*address = 0X5050; 
/* Clear Status Registers command * 7 


return(ESR) ; 
} 
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int write_during_erase(int*write_address, int*erase_address, int 


/* This procedure writes to one block while another is erasing. 


int ESR; 

/* ESR variable is used to return contents of GSR and BSR. 
int*block_base = base(erase_address) ; 

/* Find pointer to base of block being erased. 


*erase_address = 0X7171; 
/* Read Extended Status Register command 
while (OX0008 & *(block_base + 1)); 


/* Poll BSR until BSR.3 of target address = 0 (queue available). 


/* BSR is 1 word above base of target block in ESR space. 
*erase_address = 0X2020; 

/* Erase Block command 

*erase_address = OXDODO; 

/* Confirm command 

*write_address = 0X4040; 

/* Word Write command 

*write_address = data; 

/* Write actual data. 

/* Erase suspends, write takes place, then erase resumes. 
*erase_address = 0X7171; 

/* Read Extended Status Registers command 

while (!(OX0080 & *(block_base + 1))) >; 

/* Poll BSR until BSR.7 of erase address = 1 (block ready). 


/* BSR is 1 word above base of target block in status reg Space. 


ESR = (*(block_base + 2) & OXFFOO) + (*(block_base + 1) & OXOOFF) ; 


/* Put GSR in top byte and BSR in bottom byte of return value. 
*block_base = 0X5050; 

/* Clear Status Registers command 

“alg alee are 
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ASM86 ASSEMBLY LANGUAGE DRIVERS 


; Copyright Intel Corporation, 1993 

; EXAMPLE ASM86 Drivers for the 28FO16SA Flash memory component 

; Patrick Killelea, Intel Corporation 

; Revision 1.0, August 6, 1993 

; NOTE: 

; The code assumes 32-bit flat model protected mode for simplicity. 
; i.e. ES contains 0 and EDI accesses the entire memory space. 


TEXT segment byte public "CODE' 
assume cs:TEXT 


; Following is the structure by which all parameters are passed. 
params STRUCT 


erase_addr DD ? ; base of block or device to erase 
write_addr DD ? ; address to write to 

write_base DD ? ; base address of block written to 
read_addr DD ? ; address to read from 

read_base DD ? ; base address of block read from 
lock_addr DD ? ; base address of block to lock 
data_addr DD ? ; address of data to write 

data DW ? ; data word to write 
pagebuffer_start_addr DB ? ; Start address in page buffer 
pagebuffer_word_count DW ? ; number of words for pb 


read/write 


params ENDS 


; MACRO set_pin 

; This macro pushes parameters needed for the set_pin routine, calls 

; set_pin, and then pops those parameters. set_pin is an implementation- 
; dependent function which sets a given pin on the standard 28F016SA 

* pinout HIGH = 1 or LOW = 0. 


; Data needed at the beginning of this macro: 
. pans 28F016SA pin number 

; level: level to set pin 

; Trashes: CX 


MACRO set_pin pin, level 
push pin ; Push pin number of Write Protect# 
push level ; Push logic level of pin 
call ‘near ptr set_pin ; Call set_pin 
pop CX ; Pop off parameters 
pop CX 
ENDM 


3-241 


PROCEDURE compatible_block_erase 
This procedure erases a 64 Kbyte block on the 28F016SA. 
It also works with a pair of 28F008SAs. 
Param fields needed: 
erase_address: offset of base of 28FO16SA block to erase 
Output BX: CSR, duplicated in both high and low bytes 


compatible_block_erase proc near 
mov EDI,params.erase_addr 
mov ES: [EDI] ,2020H ; Block Erase command 
mov ES: [EDI] ,DODOH ; Erase Confirm command 
; Note that it is not strictly necessary to write an erase command to 
; the base of a block; any address within the block will do. 
WSM_not_ready2: 
mov AX,ES:[EDI] ; Read CSR. 
test AX,80H ; If CSR.7 = 0, test sets ZF. 
3 Erase may be suspended here to write to a different block. 
jz Short WSM_not_ready2 ; Loop while ZF is set. 
; Poll CSR until CSR.7 = 1, indicating that WSM is ready. 
mov BX, AX ; Return CSR in BX. 
mov ES: [EDI] ,5050H ; Clear Status Registers command 
ret ; Return to calling routine. 
compatible_block_erase endp 
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; PROCEDURE compatible_byte_write 
; This procedure writes a byte to the 28FO16SA. It also works with the 
; 28F008SA. 

; Param fields needed: 

: params.data: data word to be written 

: params.write_addr: offset of 28F0O16SA address to write 
; Output: BX: CSR, duplicated in both high and low bytes 
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compatible_byte_write proc near 
mov EDI,params.write_addr 
mov ES:[EDI],1010H ; Write To Flash command 


mov ES:[EDI],params.data 
; Write data to 28F016SA. 


WSM_not_readyl: 


mov AX,ES:[EDI] ; Read CSR 
test AX,80H * Lo00k at.-CSR.7. 
jz Short WSM_not_readyl ; Loop while CSR.7 = 0. 


; Poll CSR until CSR.7 = 1, indicating that WSM is ready. 


mov BX,AX ; Return CSR in BX. 

mov ES:[EDI] ,5050H , ; Clear Status Registers command 

ret ; Return to calling routine. 
compatible_byte_write endp 
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PROCEDURE 


we we we we we we we we we 


erase_suspend 
mov 
mov 


not_ready: 
mov 
test 
jz 


compatible_suspend_to_read 


This procedure suspends an erase operation to do a read. 
It also works with a pair of 28FO08SAs. 

It assumes that erase is underway. 
Param fields needed: 


params.erase_addr: offset of 28F016SA block to erase 
params.read_addr: offset of 28FO16SA address to read 


Output: BX: CSR, duplicated in both high and low bytes 


CX; data read from the address in params.read_addr 


proc near 
EDI,params.erase_addr 
ES: [EDI] , BOBOH 


AX,ES: [EDI] 
AX,80H 
Short not_ready 


Set up offset of erase address. 
Erase Suspend command 


Read CSR from any address. 


; Poll CSR until CSR.7 = 1, indicating that WSM is ready. 


mov 
mov 
mov 


; Arbitrary number of reads ca 


mov 
mov 
test 


jz 

mov 

mov 
continue: 

mov 

ret 
erase_Ssuspend 
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EDI, params.read_addr 
ES: [EDI] , FFFFH 
CX,ES: [EDI] 


ES: [EDI] ,7070H 
AX,ES:[EDI] 

AX ,0040H 

Short continue 

EDI, params.erase_addr 
ES: [EDI] ,DODOH 

BX, AX 


endp 


’ 
’ 
’ 

n 


we we we we we we we 


we 


we 


; set up offset of read address. 
; Read Flash command 


Do actual read; put result in CX. 
be done here. 

Read CSR command 

Read CSR from any address. 

If CSR.6 = 0, indicating that 
there is no erase suspended, 

jump to continue. 

Else set up offset of erase block. 
Erase Resume command 


Return CSR in BX. 
Return to calling routine. 
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; PROCEDURE device_information_upload 

; This procedure uploads status information into the page buffer. 
; Param fields needed: 

4 params.write_base: offset of 28FO16SA device 

; Output: DX: Device revision number 

$ AX, CX: trash 


Sstatus_upload proc near 
mov EDI, params.write_base 
mov ES: [EDI] ,7171H sRead ESR command. 
inc EDI sMove EDI up to GSR. 


inc EDI 


q_unavailable2: 


mov AX,ES:[EDI] sRead GSR ; 
test AX,8 
jne Short q_unavailable2 
; Poll GSR while GSR.3 = 1, indicating queue unavailable. 
wsm_busy: 
mov AX, ES: [EDI] sRead GSR 
test AX, 80H 
je short wsm_busy 


sPoll GSR while GSR.7 = 0, indicating WSM busy. 


mov ES: [EDI] ,9999H sDevice information Upload 
command 

mov ES: [EDI] , DODOH . 3Confirmation command 

mov ES: [EDI] ,7171H sRead ESR command 


WSM_busy2: 


mov AX,ES:[DI] ;READ GSR © 
test AX, 80H 
jz Short WSM_busy2 


;Poll GSM while GSR.7 =0, indicating WSM_busy 


mov ES: [EDI] ,7272H ;Swap Page Buffer command — 
mov ES: [EDI] ,7575H sRead Page Buffer command 
mov DX, [params.write_base+3] sPut revision number in DX 


sRevision number is 3 words above write_base in page buffer space. 
;GSR.5 should be checked for operation success before using revision 


number. 
ret sReturn to calling routine. 


status_upload endp 
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PROCEDURE ESR_block_erase 
This procedure erases a block on the 28F016SA. 
Param fields needed; 
params.erase_addr: offset of base of 28F016SA block to erase 
Output: BX: GSR in high byte and BSR in low byte 
AX, DX: trash 


ESR_block_erase proc near 

mov EDI,params.erase_addr ; Set up offset of address. 

mov ES:[EDI],7171H ; Read ESR command 

inc. EDI:.--.. 

; BSR is 1 word above base of target 64K block in ESR space. 
q_full4: 

mov AX,ES:[EDI] ; Read BSR 

test AX,8 


jne short q_full4 
; Loop while BSR.S of target address is 1, meaning queue full. 


mov ES:[EDI],2020H 
mov ES:[EDI] ,DODOH Confirm command 
mov ES:[{EDI],7171H Read ESR command 
sNote that EDI still contains offset of device base + l. 


Block Erase command 


we we we 


wait_BSR74: 
mov AX,ES:[EDI] ; Read BSR 
test AX,80H 
jz Short wait_BSR74 
;Loop while BSR.7 of target address = 0, i.e. block busy. 


mov BL,AL ; Store BSR in BL. 

inc EDI ; Move EDI up to read GSR. 

mov AX,ES:[EDI] ; Read GSR 

mov BH,AH ; Store GSR in BH. 

mov ES:[EDI] ,5050H ; Clear Status Registers command 
ret ; Return to calling routine. 


ESR_block_erase endp 
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: PROCEDURE ESR_Suspend_to_read 
This procedure suspends an erase on the 28FO16SA. 
; Param fields needed: 
4 params.erase_addr: offset of base of erasing 28F016SA block 
; params.read_addr: offset of 28F016SA address to read 
; Output: BX: GSR in high byte and BSR in low byte (of erase block) 
CX: data read from flash 
AX, DX: trash 


we we 


suspend_ to_read proc near 
mov EDI,params.erase_addr 
inc EDI 
; BSR is 1 word above base of target 64K block in ESR space. 
mov ES:[EDI] ,7171H ; Read ESR command 
wait_BSR75: 
mov AX,ES:[EDI] ; Read BSR 
test AX,80H 


- short wait_BSR75 
; Loop if BSR.7 of target. address is 0, meaning: ‘block bias i 


mov ES:[EDI],BOBOH 3 Operation Suspend command 

mov EDI,params.read_addr ; Set up offset of read address. 
mov ES:[EDI],7171H ; Read ESR command 

inc EDI 

inc EDI 


; GSR is 2 words above base of target 64K block in ESR space. 


WSM_busy3: 
mov AX,ES:[EDI] ; Read GSR 
test AX,80H 
jz short WSM_busy3 
; Poll GSR until GSR.7 indicates WSM is ready. 


Set up offset of read address. 
Write Read Flash Array command 
Read the data 


mov EDI,params.read_addr 
mov ES:[EDI],FFFFH 
mov AX,ES:[EDI] 


we we we 


mov CX,AX ; Store the result in CX. 

mov EDI,params.erase_addr ; Set up offset of erase address. 
inc EDI 

inc EDI 

; GSR is 2 words above base of target 64K block in ESR space. 
mov AX,ES:[EDI] ; Read GSR 

test AX,40H 


jz short nothing_suspended 
; If GSR.6 indicates an operation was suspended on this device, 
; then resume the operation. 


mov ES:[EDI],DODOH ; Resume command 
nothing_suspended: 

mov BH,AH ; Store GSR in BH. 

dec EDI ; Move EDI down to read BSR. 

mov AX,ES:[EDI] ; Read BSR 

mov BL,AL ; Store BSR in BL. 

ret ; Return to calling routine. 


suspend_to_read endp 
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; PROCEDURE ESR_word_write 

; This procedure writes a word to the 28FO16SA. 

; Param fields needed: 

: params.write_base: offset of base of 28F016SA block to write 


params.data: data word to write | 
params.write_addr: offset of 28FO16SA address to write 
Output: BX: GSR in high byte and BSR in low byte 
: AX, CX, DX: trash 


OS erm ee eee cree ae Ck ne SEE OOS ES my REY SE ES a mS MR RE RES SRW OW eRe oS eve a eg OS eet cma eee cee OY Ca eS oS eR Ca me er oe re eet Se ce emt nee es ee Lees cee mes ee oS ome re eS ee 
9 Sn a een ewer are eran en eres ewer earerarererarerarure= SS Seen SES cee sae ee Seem Mey cee see Gee) Came cesES Cease Coes Aa Geese Gers nee Ee SEES SE eee Ee ES Cen eee Ge eS Ges ee ee Gem ee eae ee 


ESR.word_write proc near 


mov AX,7171H ; Read ESR command 

mov EDI,params.write_addr ; Set up offset of write address. 
mov ES:[EDI] ,AX ; Write the command. 

mov EDI,params.write_base ; Get base of block to write 

inc EDI 

;BSR 1 word above base of target 64K block in status reg Space. 


q.full’: 
mov AX,ES:[EDI] ; Read BSR 
test AX,8 
jne short q_full 
sLoop while BSR.3 of target address 1, meaning queue full. 


mov AX,1010H ; Write Byte command 

mov EDI,params.write_addr ; set up offset of write address. 
mov ES:[EDI],params.data ; Write actual data. 

mov ES:[EDI],7171H ; Read ESR command 

mov EDI,params.write_base ; Set up offset of block base. 
inc EDI 


;BSR 1 word above base of target 64K block in status reg space. 


wait_BSR71: 
mov AX,ES:[EDI] ; Read BSR 
test AX,0080H 
jz Short wait_BSR71 
;Poll BSR while BSR.7 of target address is 0, meaning block busy 


mov BL,AL ; Store BSR in BL 

inc EDI 

;GSR 2 words above base of target 64K block in status reg space. 
mov AX,ES:[EDI] ; Read GSR 

mov BH,AH ; Store GSR in BH 

mov AX,5050H ; Clear Status Registers command 
mov EDI,params.write_addr ; set up offset of address. 

mov ES:[EDI] ,AX ; Write the command. 

ret ; Return to calling routine. 


ESR_word_write endp 
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PROCEDURE erase_all_unlocked_blocks 
This procedure erases all the unlocked blocks on a 28FO16SA. 
params.erase_addr: offset of base of device to erase 
Output: BX: GSR in both high byte and low byte 
AX, CX, DX: trash 


we we we we we we 


erase_all_unlocked_blocks proc near 

push SI ; Save old SI. 

mov EDI,params.erase_addr ; Set up offset of address. 

mov ES:[EDI],7171H s Read ESR command 

inc EDI 

; BSR is 1 word above base of target 64K block in ESR space. 
q_full5: 

mov AX,ES:[EDI] ; Read BSR 

test AX,8 


jne short q_full5 
; Poll BSR while BSR.3S of target address is 1, meaning queue full. 


mov ES:[EDI],A7A7H ; Full-chip Erase command | 
mov ES:[EDI] ,DODOH ; Confirm command 

mov ES:[EDI],7171H ; Read ESR command 

inc EDI 


; GSR is 2 words above base of target 64K block in ESR Space. 


WSM_not_ready3: 
mov AX,ES:[EDI] ; Read GSR 
test AX,80H ; 
jz Short WSM_not_ready3 
sloop until GSR.7 indicates WSM is ready 


mov AX,ES:[EDI] ; Read GSR for operation success 
test AX,20H 
jz Short chip_erase_success 


; If GSR.5 = 1, meaning that the operation was unsuccessful, 
; go through blocks, looking for the ones which EDI didn't erase. 
xor -SI,SI ; Clear SI. 
look_for_bad_erase: 
; Looking at each BSR.5 for operation success. 
mov ES:[EDI],next_block_base 


inc EDI > BSR is 1 word above base of block. 
mov AX,ES:[EDI] ; Read BSR 
test AX,20H 


jz Short ok_erased 
; record number of bad block here 


ok_erased: 
ine 51 
cmp SI,20H 
41 Short look_for_bad_erase 
mov EDI,params.erase_addr 
mov BX,ES:[EDI] 
mov ES:[EDI] ,5050H 
pop SI 
ret 
erase_all_unlocked_blocks endp 
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Set up offset of device base. 
Read GSR for return 

Clear Status Registers command 
Retrieve old SI. 
Return to calling routine. 


we we we we we 
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; PROCEDURE lock_block 
; This procedure locks a block on the 28FO016SA. 
; Param fields needed: 


params.lock_addr: offset of base of 28F016SA block to lock 
Output: BX: GSR in high byte and BSR in low byte 


; AX, DX: trash 
lock_block proc near 
mov EDI, params.lock_addr ; Set up offset of address. 
mov ES: [EDI] ,7171H ; Read ESR command 
inc EDI 
inc EDI 
q_unavailable: 
read 
test AX,8 
jne Short q_unavailable 


; Poll GSR while GSR.3 = 1, indicating queue unavailable. 


set_pin 56,1 ; EDIsable write protection. 

set._pin -15,1 ; Enable Vpp 

; Wait for ramp if necesSary. 

mov ES: [EDI] ,7777H ; Lock Block command 

mov ES :[EDI] ,DODOH ; Confirmation command 

mov ES: [EDI] ,7171H ; Read ESR command 
WSM_busy : 

mov AX,ES: [EDI] ; Read GSR 

test AX, 80H 

jz Short WSM_busy 

; Poll GSR while GSR.7 = 0, indicating WSM_busy. 

mov BH, AH ; Store GSR 

; Look at BSR.6 to see if block successfully locked. 

dec EDI 

mov AX,ES: [EDI] ; Read BSR 

mov BL,AL ; Store BSR 

mov ES: [EDI] ,5050H ; Clear Status Registers command 

ret ; Return to calling routine. 
lock_block endp 
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PROCEDURE Status_upload 
This procedure uploads status information into the ESR from non-volatile 
Status bits. 
Param fields needed: 
; params.lock_addr: offset of 28F016SA device 
Output: BX: GSR in high byte and BSR in low byte | 
AX, CX, DX: trash 


we we we we © 
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Sstatus_upload proc near 
mov EDI,params.lock_addr 
mov ES:[EDI],7171H . ; Read ESR command. 
inc EDI ; Move EDI up to GSR. 
ince EDI 

q_unavailable2: 
mov AX,ES:[EDI] ; Read GSR 
test AX,8 


jne short q_unavailable2 
; Poll GSR while GSR.3 = 1, indicating queue unavailable. 


mov ES:[{EDI] ,9797H ; Lock=status Upload command 
mov ES:[EDI],DODOH ; Confirmation command 
mov ES:[EDI],7171H ; Read ESR command 


WSM_busy2: 

mov AX,ES:[EDI] ; Read GSR 

test AX,80H 

jz Short WSM_busy2 

; Poll GSR while GSR.7 = 0, indicating WSM_busy 

mov BH,ES:[EDI] ; Read GSR 

dec EDI 

mov BL,ES:[EDI] ; Read and store BSR 

mov ES:[EDI] ,5050H ; Clear Status Registers command 

ret ; Return to calling routine. 
status_upload endp 
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: PROCEDURE pagebuffer_write_to_flash 

This procedure writes from page buffer to flash. 

Param fields needed: 
params.write_base: offset of base of 28F016SA block to write 
params.pagebuffer_word_count: number of words to write to flash 
params.write_addr: offset of 28F016SA address to write 

Output: BX: GSR in high byte and BSR in low byte of BX 
AX, CX, DX: trash 
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pagebuffer_write_to_flash proc near 
push SI | ; Save old SI. 
mov SI,params.pagebuffer_word_count ; Use SI to count words. 


; Address is where in 28F016SA flash array to begin write. The lowest 

; byte of this must be identical to the start address in the page buffer. 
; Low byte of byte_count must be 256 or fewer, high must be 0. 

; High byte exists for future Page Buffer expandability. 


mov EDI,params.write_base ; Offset of block base address. 
mov ES:[EDI],7171H ; Read ESR command 
inc EDI 
;BSR is 1 word above base of target 64K block in status reg space. 
e.fuii3: 
mov AX,ES:[EDI] ; Read BSR 
test AX,8 


jne short g_full3 
; Loop while BSR.3S of target address is 1, meaning queue full. 


mov ES:[EDI],0COCH Page Buffer Write command 
mov ES:[EDI],SI Write count 

sOnly AO valid here; low or high byte loaded depending on AO. 
mov ES:[{EDI],SI 

;AO internally complemented; alternate byte loads; write starts. 


* 
b 
e 
b 


mov ES:[EDI],7171H ; Read ESR command 
wait_BSR73: 

mov AX,ES:[EDI] ; Read BSR 

test AX,80H 


jz Short wait_BSR73 
sLoop while BSR.7 of target address is 0, meaning block busy. 


mov EDI,params.write_base 
inc EDI 
;BSR is 1 word above base of target 64K block in status reg Space. 


mov AX,ES:[EDI] 
mov AX,5050H 
mov EDI,params.write_addr 


Read 
Clear Status Registers command 
Set up offset of address. 
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mov ES:[EDI] ,AXx Write 

pop SI Retrieve old SI. 
mov BH,ES:[EDI] > Read GSR 

dec EDI 


mov BL,ES:[EDI] 

mov ES:[EDI] ,5050H 

ret 
pagebuffer_write_to_flash endp 


Read and store BSR 
Clear Status Registers command 
Return to calling routine. 


we we we 


3-252 


AP-377 


ROCEDURE 


sequential_pagebuffer_load 


P 
This procedure loads the page buffer. 
Param fields needed: 


params.write_addr: offset of origin of device 
params.data_addr: pointer to data to be written to pg buffer 
params.pagebuffer_word_count: number of words to write to pg 


params.pagebuffer_start_addr: starting pb address of data to 


Set aside room for counter 
Clear high byte of counter 
word. 


> Save old SI. 


buffer 
write 
Outputs AX, BX, DAs trash 
sequential_pagebuffer_load proc near 
sub SP,2 
mov byte ptr[BP-1],0 
push SI 
mov SI,params.pagebuffer_word_count 


. 
b] 
e 
+] 
e 
9 
9 
e 
9 


Put # of words to write in 


; SP+6 must be 128 or fewer, SP+7 must be 0. 
; High byte exists for future Page Buffer expandability. 


mov 


mov 


EDI,params.write_addr 


ES: [EDI] ,7171H 


- 
6] 
o 
> 
e 
b 


Set up offset of device 
address. 
Read ESR command 


; Commands to control entire 28FO16SA do not need to be written to any 
; particular address. 


wait_for_pb2: 


inc EDI 

inc EDI 

mov AX,ES:[EDI] 

test AX,4 

jz Short wait_for_pb2 


* Poll GSR until GSR.2 indicates that 


mov 


ES: [EDI] , EOEOH 


Point EDI to GSR. 


Read GSR 


a page buffer is available. 


SI. 


; Sequential Page Buffer Load 


e 
9 


cmd. 


; Loads high or low byte of count register, depending on AO. 


mov 


ES:[EDI],SI 


Write 


; Automatically loads alternate byte of count register. 


mov 


; Loop through 


not_done: 


DX. 


mov 
jmp 


mov 


mov 
cbw 
add 
cwd 
mov 


ES:[EDI],SI 
data, writing to page buffer. 
byte ptr[BP-1] ,0 

short compare 

DX,word ptr[BP=2] 
AL,params.pagebuffer_start_addr 
AX, DX 


BP+12, DX 


° 
- 


we we we we we we 


Write 


Load counter. 


Put current val. of counter in 


Get starting address in pb. 


Convert it to a word. 


Add to get abs. address in pb. 
Convert AX to a double word. 
Store segment of pb address 


(0). 
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compare: 


; End of loop. 


pop 
mov 
ret 


BP+10, AX 

AX,word ptr[BP=-2] 
EBX, params.data_addr 
EBX, AX 

ES,word ptr[BX] 


EDI, params.write_base 
ES:[EDI] , AX 
word ptr[BP=-2] 


AX,word ptr[BP-2] 
AX,SI 
short not_done 


SI 
SP, BP 


sequential_pagebuffer_load endp 
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a 
intel. 
Store offset of pb address. 
Get current value of counter. 
Get address of where data is. 
Add value of counter to it. 
Put data at that address on 
Stack. : 
Set up offset of address. 
Write 
Increment counter. 


Get current value of counter. 
Compare to final value. 


Retrieve old SI. 
Retrieve old SP. 
Return to calling routine. 
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: PROCEDURE Single_pagebuffer_load 
This procedure loads a single byte or word to a page buffer. 
Param fields needed: 
params.write_base: offset of base of device 
params.data: data to be written to page buffer 
params.pagebuffer_start_addr: byte giving pb location to write 
Output: AX: trash 


soaris kaennteue. load proc near 

mov EDI,params.write_base ; Set up offset of base 
address. 

mov ES:[EDI] ,7171H ; Read ESR command 

inc EDI 

inc EDI 
wait_for_pb: 

mov AX,ES:[EDI] ; Read GSR 

test AX,4 


jz Short wait_for_pb 
; Poll GSR until GSR.2 indicates that a page buffer is available 


mov ES:[EDI],7474H ; Single PB Write command 
; Actual write to page buffer. : 
add EDI,params.pagebuffer_start_addr ; Set up offset of address. 
mov ES:[EDI],params.data 
; BP+4 is location in pb to write. 
ret ; Return to calling routine. 
single_pagebuffer_load endp 
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PROCEDURE two_byte_write 
This routine is used when BYTE# is low, i.e. the 28FO16SA 
is in byte mode, to emulate a word write. 
Param fields needed: (assume existence of byte fields data_high and 
data low) 
params.write_base: offset of base of 28FO16SA block to write 
params.data_high: high data byte to write 
params.data_low: low data byte to write 
params.write_addr: offset of 28FO16SA address to write 
Output: BX: GSR in high byte and BSR in low byte 
AX, CX, DX: trash 
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two_byte_write proc near 

mov EDI,params.write_base ; Set up offset of address. 

mov ES:[EDI],7171H ; Read ESR command 

inc EDI 

; BSR is 1 word above base of target 64K block in ESR space. 
gq full2Zs 

mov AX,ES:[EDI] ; Read BSR 

test AX,8 


jne short q_full2 
; Loop while BSR.3 of target address is 1, meaning queue full. 


mov ES:[EDI],FBFBH ; Two=-byte write command 
; Write low byte of data word 
mov EDI,params.write_addr ; Set up offset of address. 


mov ES:[EDI],params.data_high 
mov ES:[EDI],params.data_low 


; 28FO16SA automatically loads alternate byte of data register and 
; initiates write. Now we check for successful completion. 


mov ES:[EDI],7171H ; Read ESR command 
mov EDI,params.write_base 
inc EDI 


; BSR is 1 word above base of target 64K block in ESR space. 


wait_BSR72: 
mov AX,ES:[EDI] ; Read BSR 
test AX,80H 
jz Short wait_BSR72 
; Poll BSR while BSR.7 of target address is 0, meaning block busy. 


mov BH,ES:[EDI] ; Read BSR 

inc EDI 

mov BL,ES:[EDI] ; Read and store GSR 

mov ES:[EDI] ,5050H ; Clear Status Registers command 
ret ~ 3 Return to calling routine. 


two_byte_write endp 
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PROCEDURE write_during_erase 
This procedure writes to one block while another is erasing. 
Param fields needed: 
params.data: data word to write to 28FO16SA 
params.erase_addr;: offset of 28FO16SA address to erase 
params.write_addr: offset of 28FO16SA address to write 
Output: BX: GSR in high byte and BSR in low byte 
AX, DX: trash 
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write_during_erase proc near 

mov EDI,params.erase_addr ; set up offset of address. 

mov ES:[EDI],7171H ; Read ESR command 

inc EDI 

; BSR is 1 word above base of target 64K block in ESR space. 
q_full6: 

mov AX,ES:[EDI] ; Read BSR 

test AX,8 ; 


jne short q_full6 
; Loop while BSR.3 of target address is 1, meaning queue full. 


mov ES:[EDI] ,2020H ; Write Erase Block command 
mov ES:[EDI],DODOH ; Erase Confirm command 
mov EDI,params.write_addr ; Set up offset of address. 


mov ES:[EDI],4040H Write Word command 
mov ES:[EDI],params.data ; Write actual data 


; Erase will suspend, write will take place, then erase resumes. 


mov EDI,params.erase_addr ; Set up offset of address. 
mov ES:[EDI],7171H ; Read ESR command 
inc EDI 


; BSR is 1 word above base of target 64K block in ESR space. 
wait_BSR76: 
read 
test AX,80H 
jz Short wait_BSR76 
; Loop while BSR.7 of target address is 0, meaning block busy. 


mov EDI,params.erase_addr ; Set up offset of address. 
mov BH,ES:[EDI] ; Read BSR 
inc EDI 


mov BL,ES:[EDI] ; Read and store GSR 
mov ES:[EDI] ,5050H ; Clear Status Registers command 


ret ; Return to calling routine. 
write_during_erase endp 
TEXT ends 
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GLOSSARY OF TERMS 
BSR: Block Status Register. Each BSR reflects the status of its 64 KB block. 


CSR: Compatible Status Register. The CSR reflects the status of the entire device and is identical in format to the 
Status Register of the 28FOO8SA. 


DSR: Device Status Register. The contains device revision number after Status Upload command. 
EDI: Extended Data Index register on 80386 and higher CPUs. 

ESR: Extended Status Registers. The GSR and BSRs. 

GSR: Global Storage Register. The GSR provides additional information about entire device status. 
RY/BY #: Output pin from the 28FO16SA indicating status of current operation. 

Vpp: Voltage necessary to program the 28FO16SA (12V). 


WSM: Write State Machine. On-board “processor” automating write, erase and other functions 
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1.0 INTRODUCTION 


1.1 Overview of Enhanced Features 


The Intel family of flash memory components has a 
new member: the 28FO16SA 16-Mbit Flashfile™ 
memory. The 28FO16SA provides superior write 
performance and ultra high density, making possible 
faster, smaller form-factor flash memory sub-systems 
than ever before. Flash memory cards and flash drives 
will reach higher levels of performance with the 
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advantage of special 28FO16SA features, such as low 
power operation, data security, and flexibility of use. 


This application note describes in detail the new 
features of the 28FO16SA and the benefits of these 
features to the system designer and system end-user. 
Readers wishing technical specifications are referred to 
the 28FO16SA data sheet; readers wishing - usage 
guidelines are referred to the 23FO16SA User's Manual. 


The following table summarizes the enhanced features 
and advantages of the 28FO16SA: 


28F016SA, while new applications will arise to take 


Table 1. Feature vs. Value Summa 


Feature of 28FO16SA | Advantage to System Designer Advantage to End-User 


FASTER WRITES, e Wider range of applications e Faster write to flash cards, 
APPROACHING HARD e Faster installation of embedded flash drives 

DISK WRITE code e Faster formatting of cards, 
PERFORMANCE e Quicker code update in the field drives 

over a modem line 

e New products possible 

e Increased data acquisition capacity 
e Higher capacity cards, drives, 
Resident Flash Arrays (RFA) 

e Fewer parts = better 
manufacturability and reliabili 

e Optimized system power budget 


HIGHER DENSITY, 
ENABLING HIGH 
CAPACITY SOLID STATE 
MASS STORAGE 


e Smaller systems, lower 
weight, lower power 
consumption 

e More room for user data on 
flash cards & RFAs 


LOW POWER 
CONSUMPTION 


e Longer battery life 

e Smaller batteries 

e Less weight 

e User is safe from accidental 
modification of OS or 
application code 

e Data file securi 

e 28F016SA-based cards can 
be used to transfer data 
between 3.3V portable and 
5.0V desktop PCs 


CODE/DATA 
PROTECTION 


e Opportunity to ship device drivers 
and application code bundled with 
cards, RFAs and embedded systems 


FLEXIBLE SYSTEM 
INTERFACE 


e More compact systems 
e Optimal bus loading 
e More detailed status information 
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1.2 Glossary of Terms 


APS: Automatic Power Savings feature of 
28FO16SA. 


CSR: Compatible Status Register. The CSR reflects 
the status of the entire device and is identical in 
format to the Status Register of the 23FOO8SA. 


ESR: Extended Status Registers. The GSR and 
BSRs. 


GSR: Global Storage Register. The GSR provides 
additional information about entire device status. 


BSR: Block Status Register. Each BSR reflects the 
status of its 64 KB block. 


CEp#: Chip Enable 0. CEp# and CE, # both need to 
be asserted to activate the 28FOI6SA. 


CUI: Command User Interface. Interface between 
the microprocessor and the internal memory 
operation. 

FFS: Flash File System. Software providing file 
structure and maintenance for mass storage with 
flash. : 

OE#: Output Enable pin. 


RFA: Resident Flash Array. Array of flash 
components permanently resident on a motherboard. 


RFX: Resident Flash XIP. 

RFD: Resident Flash Disk. 

RP#: Reset Power-Down pin. Master enable switch 
for the 28FO16SA. Formerly called PWD# on 
28FO08SA. 


RY/BY#: Configurable Ready/Busy pin, giving 
status of pending operations. 


WE#: Write Enable pin. 
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WP#: Write Protect pin. Can be used to override 
block lock status bit in BSRs. 


WSM: Write State Machine. On-board "processor" 
automating Write, Erase, Lock and other functions. 


XIP: Execute In Place. 


2.0 INNOVATIVE ARCHITECTURAL 
ENHANCEMENTS 


While the 28FO16SA is compatible with the 
28FOO8SA, the 28F016SA_ includes hardware 
enhancements which provide the basis for the 
features described in the following sections of this 
document. 


The hardware enhancements include: 


e An improved Command User Interface 

e Two Page Buffers 

e Queue Registers 

e Extended Status Registers 

e Several new pins, implementing new functions. 


The Command User Interface (CUI) of the 
28FO16SA understands 17 new commands which 
simplify usage or provide access to entirely new 
functions. The CUI is, however, still accessed in the 
same manner as with the 28FOO8SA and all of the 
28FO08SA commands are valid for the 28FO16SA. 


Two page buffers of 256 bytes each greatly increase 
the effective write speed. The page buffers are 
written at SRAM speeds. Writes from full page 
buffers to the flash array can be initiated with a 
single command and will complete independently, 
freeing the CPU for other tasks. 


The Queue Registers can accept up to two (2) 
additional commands while the current command is 
executing. This allows a short sequence of 
commands to be issued quickly, regardless of 
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whether the internal Write State Machine (WSM) is 
actually ready to process a command. The WSM will 
automatically fetch the next command from the 
queue when it is ready. 


The Extended Status Registers provide more detailed 
information about the state of the 28FO16SA, such 
as the state of the queue and which page buffer is 
selected. A Global Status Register and a set of thirty- 
two (32) Block Status Registers give the system 
designer the ability to use each 64-Kbyte block as an 
independent memory. 
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Figure 1. 28F016SA Block Diagram 


ARCHITECTURAL EVOLUTION IS INDICATED WITH SHADED FUNCTIONAL BLOCKS. 
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3.0 ENHANCED WRITE 
CAPABILITY 


The write performance of the 28FO16SA is far 
superior to that of previous flash components. For a 
direct write to flash, the 28FO16SA has a 6 us 
average word write time, a 33% improvement over 
the 28FOO8SA. Much more significant, however are 
the on-board page buffers and Auto Erase Suspend 
capability, which boost write performance much 
more by reducing system overhead. 


3.1 Page Buffer Writes to Flash 


The 28FO16SA incorporates two page buffers of 256 
bytes each. The page buffers. can be written with 
SRAM.-like timings and will program the flash array 
without any CPU overhead, providing greatly 
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increased write efficiencies for both short and long 
writes. 


For example, the 28FOO8SA writes a byte typically 
in 9.2 us/byte, giving a device pair an effective byte 
write speed of 4.6 us since 9.2 us per byte/2 
devices=4.6 us per byte/device. 


The 28F016SA, however, can write a word typically 
in 3.8 ps from page buffer to flash memory, giving a 
device pair an effective byte write speed of 0.95 us 
since 3.8 ws per word/2 devices = 1.9 us per 
word/device = 0.95 us per byte/device. 


This feature improves system write performance by 
up to 4.8 times over previous flash memory devices. 
When interfacing four (4) 16-Mbit devices in 
parallel in a 32-bit system, the sustained write speed 
approaches 2 MBytes/sec. 


MAXIMIZING WRITE PERFORMANCE WITH PAGE BUFFERS 


No Page Buffers 


16-bit bus 


Effective Byte 


4.6 usec 
Write Speed : 


Write Speed 0.22MB/sec 


One Page Buffer Active on Each Device 


Ba 


16-bit bus 


0.95 usec 


1MB/sec 


WRITE PERFORMANCE IMPROVEMENT = 4.8X 


{ 


Figure 2. Page Buffer Increases Write Performance 
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For relatively short writes (less than 512 bytes), the 
CPU is free after the page buffers are loaded and the 
command to write to flash is issued. The 28FO16SA 
will take care of completing the Page Buffer Write to 
Flash Operation. This limited form of parallel 
processing allows the host system to treat flash 
almost exactly as it would treat SRAM for short 
writes. For writes of less than four (4) bytes, 
however, it is not efficient to use the page buffers 
because the queue can hold three (3) simple Write 
commands. 


For writes of more than 512 bytes, the two page 
buffers can be used to even greater advantage. The 
system can fill one buffer, issue the Write command, 
and then immediately begin to fill the other buffer, 
continuing to alternate in this way until the entire 
write is complete. This sort of large block writing, 
known as "interleaved page mode write," is efficient 


\ 


because the overhead needed to set up a write from 
the buffers to flash is incurred only once. Also note 
that the write from the buffers to flash is itself faster 
than a write directly from the system to the flash 
array. 


The load on the CPU is also dramatically reduced 
using page mode writes. While a write without the 
page buffer requires one setup command for every 
byte or word written, only 6 commands total need to 
be issued to set up the write of 256 bytes to a page 


buffer and from the page buffer to flash. While the 


actual write speed to the flash array is approximately 
35% faster from the page buffer, there is also the 
benefit of huge reduction in processor overhead, 
with page buffer writes more than 40 times (256 
commands vs. 6 commands) less of a burden on the 
CPU. 


THE TWO PHASES IN THE INTERLEAVED PAGE MODE WRITE CYCLE. 
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Figure 3. Interleaved Page Mode Write 
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3.2 Command Queuing 


While the 28FOO8SA requires an operation to 
complete before the next operation could be 
requested, the 28FOI6SA allows queuing of up to 
two (2) additional operations while the memory 
executes the current operation. As a general rule, the 
28FO16SA has a 3-deep command queue. This 
eliminates system overhead when writing several 
bytes in a row to the array or erasing several blocks 
at the same time. A subset of the command-set can 
be queued, while the rest of the commands are 
executed immediately. 


There is, however, an exception to the 3-deep 
-command queue rule, which has to do with multiple 
Block Erase commands. If Single Block Erase 
commands are the only queued operations, the queue 
then becomes virtually 32-commands deep. This 
allows the user to stack many Block Erase 
operations very fast before a Single Block Erase 
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operation completes. Consult the 28FO16SA User's 
Manual 


3.3 Command Prioritization 


Within the 28FO16SA command queue, Write 
commands have higher priority than Erase 
commands and are executed by the WSM first, 
regardless of the command order. This feature helps 
insure that valuable data can be captured as it arrives 
in real time. The 28F016SA will not, however, put a 
write to a block ahead of an erase to the same block. 


In addition, the 28FO16SA prioritizes multiple Block 
Erase commands when queued in conjunction with 
Write commands. The CUI decodes the Write 
commands and if those commands affect a block 
which is in the queue for erasing, it will prioritize 
the Block Erase ahead of other Block Erase 
operations. This method allows a complete block 
modification to occur as fast as possible. 


Command User Interface 


Priority Resolver 


Write State Machine 


COMMANDS ARE PRIORITIZED WITHIN THE CUI BEFORE BEING SENT TO THE WSM. 


Figure 4. Command Prioritization 
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3.4 Extended Status Registers 


The 28FO16SA includes a Compatible Status 
Register (CSR) which is identical to the status 
register on the 28FOO8SA, a Global Status Register 
(GSR), which reflects the overall device status, and 
32 Block Status Registers (BSRs), which are similar 
to the GSR except that they contain information 
specific to their corresponding blocks, i.e., each 
block has its own BSR. The value of the BSR is that 
it allows each block to operate essentially as an 
independent memory device. 


Since the CPU does not have to control and monitor 
the details of writing a word/byte and erasing a 
block, it is free to perform higher priority tasks. 


3.5 Automatic Erase Suspend to 
Write 


Write performance is also enhanced by an erase 
suspend mode which is automatically invoked when 
a Write command to a block is issued during the 
erase of a different block. Since the erase of a block 
typically takes 600 milliseconds to complete, 
suspending an erase to write to a different block can 
dramatically increase write performance. 


Erase in Progress 


Write Issued 


Automatic Erase Suspend to Write is important to 
Microsoft's Flash Filing System (FFS) for flash 
memory cards. FFS needs to perform occasional 
background erases to maintain efficiency. These 
erases are much less noticeable when they can be 
suspended whenever the user desires access to the 
flash card. 


3.6 Block Validity and Data 
Integrity 


If a particular block becomes corrupted because of 
an interrupted Erase operation, due to an Abort 
command, RP# reset action or the power supply 
turning off, both the Block Operation Status (BOS) 
and Device Operations Status (DOS) bits will be set 
to "1," indicating an Invalid Block. This 
combination of status bit setting can be detected 
when normal operating conditions are restored and 
after issuing a Status Upload command, which 
updates certain status bits in the GSR and BSRs. If 


‘this condition occurs (BOS = DOS = 1), the user 


must re-issue a Block Erase command and insure 
successful erasure of the block by checking the 
appropriate GSR and BSR bits. 


Fae: See) 


= 


NE NS 
SS 


Erase Suspends, 
Write Takes Place 


Erase Completes 


28F016SA BLOCK ERASE AUTOMATICALLY SUSPENDS IF WRITE TO DIFFERENT BLOCK IS ISSUED. 


Figure 5. Automatic Erase Suspend to Write 
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3.7 Erase All Unlocked Blocks 


All 32 blocks of the 28FO16SA can be erased using 
a single command, the Erase All Unlocked Blocks 
command. When this command and the Confirm 
command are issued, then all of the unlocked blocks 
will be erased in sequence. Locked blocks will be 
skipped and no error code will be returned. The BSR 
Block Operation Status bit can then be checked for 
each block to determine which block failed to 
properly erase and the user can re-issue single Erase 
commands to those particular blocks. This method 
improves overall system write performance in large 
flash memory configurations when extensive data 
cleanup or card formatting are required. 


Table 2. 28F016SA Typical* Power Consum 


ICC (mA) IPP (mA) Power (mW) Energy (m.W.sec) 
ICC xX 3.3V + IPP x Vpp Power x Time 


3.3V Operation 
f = 4 MHz 


Read Current 


Erase Current 


5.0V Operation 
f = 10 MHz 
Read Current 


Block Size= 64 KB = 32 KW 
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4.0 LOW POWER CONSUMPTION 


4.1 3.3V Operation 


For Read operations, the 28FO16SA uses about 50% 
less energy in the 3.3V configuration than in the 
5.0V configuration, making the 28FO16SA an ideal 
choice for mobile computing applications as well as 
some power-sensitive embedded applications which 
use the device for infrequently updatable code 
storage. 


For Write/Erase operations such as in Resident Flash 
Disk applications, the 28FO16SA in 3.3V mode 
saves 20% / 40% energy respectively, versus the 
5.0V mode. See Table 2 for detailed calculations. 


tion and Energy Comparison 


Write Current — a ese 146.4 32.38 mW.sec/Block 


ICC (mA) IPP (mA) 
nance Pill ur 
ie ee a 


*These numbers are based on preliminary characterization data. 


Power (mW) 


Energy (m.W.sec) 
ICC x 5.0V + IPP x Vpp Power x Time 
0.82 mW.sec/Block 


ee ee 


90 mW.sec/Block 


Typical word write speeds: 6 psec (5.0V); 6.75 usec (3.3V). 
Typical block erase speeds: 600 msec (5.0V); 800 msec (3.3V) 
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Table 3: 3.3V to 12.0V Converters 


Manufacturer Part Input (V) Current Total Est. Cost * 
Number Output Components 
Needed 

Linear Technology | 1109CS8-12 | 2.5 to 11.0 30mA $4.00 


*These cost estimates are based on published pricing at the time this Application Note was written. 


NOTE: 


This list is intended for example only, and in no way 
represents all companies that produce 12.0V 
conversion solutions. Since this industry develops 
many new solutions each year, Intel recommends 
that the designer contact the vendors for their latest 
products. Intel will continue to work with vendors to 
develop optimum solutions. Intel Corporation 
assumes no responsibility for circuitry others than 
circuitry embodied in Intel products. 


At present, there are at least two manufacturers of 
3.3V to 12.0V converters. Their solutions are 
described in Table 3. These solutions are given only 
for reference and may not be suitable for use in 
every system. Readers’ wishing additional 
information on DC to DC converters are referred to 
Intel's AP-357, "Power Supply Solutions for Flash 
Memory." 


4.2 Page Buffer Write Operation 


In addition to providing dramatically faster writes, 
the page buffers also save power. While the actual 
power saved depends on the size of the write from 
the page buffer, savings are typically 35% of the 
energy it takes to write without the page buffer, 
since page buffer writes are intrinsically about 35% 
faster while current consumption is the same. 


4.3 Automatic Power Savings 


Automatic Power Savings (APS) is a low power 
feature valid during active mode of operation. The 
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28FO16SA incorporates "Power Reduction Control" 
circuitry which allows the device to put itself into a 
low current state when addresses are not switching 
(in other words, accessing the same memory 
location). After data is read from the memory array, 
the Power Reduction Control logic controls the 
device's power consumption by entering APS mode, 
where the typical ICC current is 1 mA at 5.0V and 
0.8 mA at 3.3V. CPUs with a slowed clock can take 
advantage of this feature which is entirely automatic 
and transparent to the user. 


4.4 Deep Power-Down Mode 


The deep power-down mode is activated by the RP# 
pin transitioning low, which turns off all device 
circuitry. The only current consumed is diffusion 
leakage, transistor sub-threshold conduction, input 
leakage, and output leakage, totaling 1 pA. 
However, all register contents are lost and the 
current operation terminates upon entering deep 
power-down mode. 


The deep power-down feature, along with the sleep 


command (following section), gives the 28FO16SA 
the ability to increase power savings dramatically by 
taking advantage of the fact that any one flash 
device is accessed only occasionally. When the 
device is not in use, it can be turned off so that 
scarce battery power is consumed only as needed. 
These power-saving functions can be implemented 
in ways entirely transparent to the end-user. The 
only change the user will notice is that batteries last 
much longer with a 28F016SA-based system. 
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4.5 Sleep 


The Sleep command is new with the 28FOI16SA. 
Unlike deep power-down mode, during sleep mode, 
the status registers, page buffers, and signature ID 
codes can still be read. Once in sleep mode and with 
applied CMOS input levels, the power of the device 
is reduced to deep power-down current levels. The 
Sleep command allows the device to complete any 
current or pending commands before going into 
sleep mode. The Device Sleep Status (DSS) bit in 
the GSR will indicate that the device is in sleep 
mode. Writing the Read Array command wakes up 
the device out of sleep mode. 


4.6 Standby 


With CEp# or CE,# high, the memory will be in 
standby mode. This mode turns off much of the 
device's circuitry and reduces device power 
consumption. The outputs are in a high-impedance 
state independent of the state of OE# pin. If the 
WSM is executing a command when the device is 
disabled, the operation is allowed to continue. 
During this time the power consumption remains at 
the non-standby level until the operation completes. 
The output buffers and most of the input buffers on 
the chip are disabled during standby mode. 


5.0 DENSITY IMPROVEMENT/ 
SPACE SAVINGS 


The 28F016SA is twice as dense as the 28FOO8SA, 
allowing smaller systems, lower weight, and lower 
power consumption than ever before—crucial selling 
points in the highly competitive mobile PC market. 
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Flash densities are now on a par with DRAM 
densities, an important step toward the use of flash 
as non-volatile executable memory (Resident Flash 
Array), which provides "instant on" boot capability 
and instant access to applications and data stored in 
flash. RFAs also reduce the amount of necessary 
system DRAM. 


In the removable storage market, the density of the 
28FO16SA will make conversion to flash the most 
attractive option when considered along with the 
properties which set flash apart from other storage 
media, such as_ non-volatility, low power 
consumption, and ruggedness. Flash-based data and 
code storage media such as PCMCIA memory cards 
are already on the shelf, along with PCMCIA-ATA 
flash drives. PCMCIA cards in particular will open 
new distribution channels for software since cards 
based on the 28FO16SA now have sufficient 
capacity for most large commercial programs. While 
cost/megabyte is not yet competitive with magnetic 
media, the XIP or "eXecute In Place" ability of flash 
cards provides software distributors and end-users 
with a compelling reason to consider flash cards. 


The density of the 28FO16SA is also driving entirely 
new applications, such as_ solid-state digital © 
photography and audio recording, which require 
memory capacities which were not previously 
economical in flash. 


The point to remember is that two (2) megabytes of 
70 ns randomly accessible code or data can now be 
stored in a rewritable nonvolatile medium of less 
than three (3) square centimeters—a 30% 
improvement over the 28FOO8SA. | 
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Two Devices 
80 Pins Total 


2 
400 mm _ Total 


One Device 
56 Pins 


280 mm ; 30% Area Savings 


16 Megabits of Flash Memory - 2 Ways 


28F016SA DENSITY ENABLES SMALLER FLASH APPLICATIONS, EASIER MANUFACTURING 


AND GREATER RELIABLITY. 


Figure 6. 28F016SA vs. 28FO08SA Area Comparison 


6.0 FLEXIBLE SYSTEM INTERFACE 


6.1 Dual Chip Enables 


The 28FO16SA implements a dual chip-enable 
function with two input pins, CEp# and CE,#, 
which together have exactly the same functionality 
as the regular chip-enable pin on the 28FOO8SA. The 
28FO16SA uses the logical combination of these two 
signals to enable or disable the entire chip. Both 
CEp# and CE,# must be active to enable the device. 
If either one becomes inactive, the chip will be 
disabled. This feature allows the system designer to 
reduce the number of decoding pins used in a large 
array of 16-Mbit devices. For square arrays, it can be 
seen that the number of lines needed to control nXn 
chips is 2 times n. For example, in a square array of 
sixteen 28FO16SAs, only 8 lines are needed instead 
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of 16 (see Figure 7). For larger memory arrays, the 
reduction in decoding signals increases significantly. 


6.2 Dual 3.3V/5.0V Operation 


The portable PC market demands that components 
be able to operate at 3.3V. On the other hand, most 
desktop systems operate at 5.0V. The 28F016SA 
resolves this conflict with a dual operating voltage 
capability. A 3/5# input pin makes it possible to use 
the 28FO16SA in both 3.3V and 5.0V systems 
interchangeably. The 3/5# signal pin from the 
system informs the device about the supply voltage 
being used. This information is used by the 
28FO16SA to optimize itself for the input supply 
voltage. Data written using one supply voltage will 
always be valid using the other supply voltage. A 
28F016SA-based flash memory card is thus able to 
transfer data from a 3.3V notebook or handheld PC 
to a 5.0V desktop PC. 
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Dual chip selects reduce the total number of select lines needed. 


Figure 7. Dual Chip Selects in a Bank Configuration 
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3.3V System 


5.0V System 


Figure 8. Dual Voltage Operation Allows Inter-Operability 


6.3 User-Selectable x16/x8 Bus 
Width | 


While the 28FOO8SA's interface to the system bus is 
strictly x8, the 28FO16SA's BYTE# pin allows either 
a x8 or x16 bus interface. The system designer now 
has a choice between three (3) different 
configurations in both 16-Bit and 32-Bit systems, 
allowing optimization of the effective block 
granularity, the space required, and the minimum 
memory configuration. See Table 4 for details. 
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Note that the smallest block granularity is obtained 
with the 28FO16SA in 16-bit mode in a x16 system. 
The most efficient and smallest memory 
configuration is obtained with the 28FO16SA in x16 
mode in a 32-bit system. 


6.4 Open Drain RY/BY# 


The RY/BY# pin is an open drain output pin to 
allow the designer to Wire-OR multiple RY/BY# 
pins in a large memory array, saving on the number 
of control pins which are dedicated to this function. 
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Table 4. Configuration Options 


28F008SA (x8 only) 28F016SA, x8 28F016SA, x16 
Size 
16-Bit Effective Block Size 128 KB 128 KB 
System 
Minimum Configuration Two Devices:2 MB Two devices:4 MB One device: 2 MB 
System 
Minimum Configuration Four Devices: Four devices: 
4MB 8 MB 4MB 


10KQ - 100KQ 


CPU Interrupt 


OPEN DRAIN RY/BY# REDUCES THIS ARRAY'S INTERRUPT LINES TO JUST ONE. 
Figure 9. Open Drain RY/BY# 
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EXAMPLE OF PULSED MODE RY/BY# IN AN ARRAY OF TWO DEVICES 


RY/BY# 
Device 0 


RY/BY# 
Device 1 


Oa eS ne eee RED pee Lets Meu: 


With devices in Level-Mode operation, this array's output does not indicate 
exactly when device 0 has finished its operation. 


RY/BY# 
Device 0 


RY/BY# 
Device 1 


Array RY/BY# 


'R= 250 ns typically 


t 


—| 


R 
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With devices in Pulsed-mode Operation, this array's output does indicate 
exactly when Device 0 has finished its operation. 


Figure 10. Pulsed Mode RY/BY# 


6.5 RY/BY# Configuration Modes 
(Level & Pulsed) 


While the Level-Mode operation of the Ready/Busy 
indicator pin continuously reflects the device 
readiness, this type of signal will actually hinder the 
performance of an array of 28FO16SAs if the array 
itself has only one ready/busy output line. This is 
because the array output will indicate busy when any 
one of its component 28FO16SAs is busy, obscuring 
transitions to ready by any of the other devices and 
forcing the CPU to continuously poll the flash array 
to find ready devices. 
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A more accurate indication of the array state is 
obtained when each 28FOI6SA gives a_ pulsed 
output signal to the host system when it has finished 
its operation. The host system can then examine the 
Global Status Register of each 28FO16SA to find 
which one has become ready and issue a Read 
command, or any non-queueable command, to the 
ready device. In this way, multiple devices can 
operate in parallel without the burden of continuous 
polling to find which ones have finished their 
operations. 
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The 28F016SA incorporates a RY/BY# pin which 
can be configured four ways: 


e Level Mode (Default) 
e Pulse-on-Write Only 
e Pulse-on-Erase Only 
e Disable 


Level mode is the default mode. In _ this 
configuration, the state of the WSM is continuously 
indicated by the RY/BY# pin, which is an open 
drain output pin pulled high through an external 
pull-up resistor when the WSM is ready. This feature 
allows the user to OR-tie RY/BY# pins of multiple 
devices together in flash memory arrays such as 
Resident Flash Array or flash drive applications, 
saving control logic and simplifying board design. 


Pulse-on-write mode will cause RY/BY# to pulse 
low at the completion of Page Buffer Write to Flash 
operations only. This is useful for controlling 
interleaved page mode writes. 


Pulse-on-erase mode will cause RY/BY# to pulse 
low at the completion of Block Erase operations, 
including at the end of each Block Erase during an 
Erase All Unlocked Blocks operation. 


The RY/BY# pin can also be disabled so that it will 
always report a READY condition. Disabling the 
RY/BY# pin has no impact on the status registers. 


7.0 CODE AND DATA PROTECTION 


7.1 Selective Block Locking 


While the 28FOO8SA provides data security through 
the RP# pin (formerly PWD#) and the intrinsic non- 
volatility of flash, it does not have the ability to 
provide selective locking of some blocks while 
leaving others available for writing and erasing. The 
28FO16SA, however, provides the ability to 
selectively lock any 64-Kbyte block to protect 
critical code or data. Each block on the 28FO16SA 
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has an associated non-volatile lock-bit which 
determines the lock status of that block. 


7.2 Master Write Protect 


A WP# (Write Protect) pin activates the block lock- 
bits, preventing any Write or Erase of blocks which 
have their lock-bits set. When the WP# pin is 
asserted (low) and a block's lock-bit is set, the user is 
safe from accidentally damaging or modifying the 
data in that block. 


7.3 Software Partitioning 


The greatest benefit of the 28FOI16SA's block 
locking feature is that it is possible for OEMs and 
software developers to bundle applications or 
operating system code in flash memory cards or in 
RFAs, providing an entirely new medium for 
software distribution. Software distributed in this 
way is safe from accidental user overwrites, and yet 
capable of in-system updates to accommodate new 
versions. When 28F016SA-bundled code or data 
needs to be updated, raising WP# high provides a 
temporary override of the block locking mechanism 
so that locked blocks on the device may be written 
to. 


The advantage of partitioning a 28F016SA-based 
memory card into locked and unlocked sections is 
that a user can keep an application and the files 
created with that application together. For example, 
a spreadsheet program and all of the spreadsheets a 
user has created with that program can be stored on 
one flash card. Such an arrangement gives the user a 
new kind of portability, one which allows him or her 
to carry all of the work in his or her pocket with 
instant access to the application and files anywhere a 
compatible PC is available. Hence, the data locking 
features of the 28FO016SA complements its ability to 
act as executable system memory, providing the end- 
user with a solution which provides portability, 
safety, convenience, low power and high speed of 
access which no other medium can claim. 


3-277 


AP-378 


Block-locking feature allows 


selective write protection of 


code blocks crarecencenenceiramenmmm mms a 


Memory Card Based on 28F016SA 


User Data Area 


Figure 11. Block Locking and Code/Data Partioning 


7.4 Reset Capability 


The 28F016SA provides complete protection of 
flash contents through the Reset/Power-down (RP#) 
pin. RP# locks the flash array from spurious writes 
and places the outputs in a high impedance state. If 
asserted during write/erase modes, RP# low aborts 
the current operation in progress, cancels all pending 
WSM commands, flushes the command queue and 
clears the status registers. 


RP# is used both as a power conservation feature 
and as a data protection feature. An example of 
when RP# is useful for data protection is during 
power-up, when other inputs to the 28FO16SA may 
be in an indeterminate state. Holding RP# low until 
the power supplies reach operating levels and all 
input signals become stable, guarantees maximum 
protection for the device. The use of RP# for power 
conservation is discussed in section 4.4. The reader 
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wishing more detail on the use of the RP# pin is 
referred to the 28FO16SA User's Manual. 


8.0 Summary 


This application note discusses the key features and 
benefits of the revolutionary 16-Mbit device 
architecture and their impact on system and software 
designs. End-user benefits from these enhanced 
features are brought to light with respect to the wide 
range of new applications enabled by the 28FO16SA 
chip and 28F016SA-based system products. 
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Codes (Hex 
Invalid/Reserved 3 


Word/Byte Write 
Single Block Erase 


28F008SA- Word/Byte Write 
Compatible Clear Status Registers 


28F016SA 
Performance- 
Enhancement 
Commands 


Two-Byte Write 


Commands 
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INTRODUCTION 


The ETOX III (EPROM tunnel oxide) 28FOO8SA is a 
high-density product offering from Intel’s second gen- 
eration of flash memory devices. This 1,048,576 x 8 
memory with its symmetrical blocking (16 blocks x 
64 Kbytes), very high cycling endurance, on-chip 
write/erase automation, and erase-suspend/resume ca- 
pability can be termed a block-alterable non-volatile 
RAM. In addition to selective block erasure, integrated 
Command User Interface (CUI), Write State Machine 
(WSM), Status Register, and deep power-down capabil- 
ity, the 28FOO8SA adds a dedicated READY/BUSY 
output (RY/BY #). This new feature provides immedi- 
ate hardware signaling of byte-write/block-erase com- 
pletion and erase-suspend/resume actuation. 


Flash memories combine inherent non-volatility with 
in-system alterability of device contents. Advances in 
process control have allowed development of a double- 
polysilicon single-transistor flash memory capable of 
100,000 write/erase cycles per block. The 28FOO8SA 
electrically erases all bits in a block via electron tunnel- 
ing. The EPROM programming mechanism of hot- 
electron injection is employed for high-performance 
electrical byte write as required for file and data storage 
applications. 


The Command User Interface and Status Register in- 
terface to power-up/down protection, address/data 
latches, and the Write State Machine (which in turn 
controls internal byte write, block erase, cell-margin 
circuits, and the dedicated READY/BUSY status out- 
put). These features augment prior flash memory cir- 
cuitry to optimize Intel’s 28FOO8SA for microproces- 
sor-controlled byte write and block erase. 


Read timing parameters are comparable to those of 
CMOS DRAMs, SRAMs, EPROMs, and EEPROMs. 
The 85 ns access time results from a memory cell-cur- 
rent of approximately 70 wA, low-resistance polysili- 
cide wordlines strapped with metal, advanced scaled 
periphery transistors, and an optimized data-out buffer. 


The dense one-transistor cell structure, coupled with 


high array efficiency, yields a one-megabyte die mea- 
suring 539 by 286 mils. 
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TECHNOLOGY OVERVIEW 


Intel’s ETOX III flash memory technology incorpo- 
rates advances from ETOX I and ETOX II processes 
and leverages over two decades of EPROM manufac- 
turing experience. Using advanced 0.8 1m double-poly- 
silicon N-well/P-well CMOS technology, the 1,048,576 
x 8-bit flash memory employs a 2.5 wm x 2.9 um sin- 
gle-transistor cell affording array density equivalent to 
comparable EPROM technology, and twice that of In- 
tel’s ETOX II process. The ETOX III flash memory 
cell is identical to EPROM, with an additional source 
implant which optimizes erase performance. Figure | 
shows a cross-section of the flash memory cell. 


High-quality tunnel oxide under the single floating 
polysilicon gate promotes electrical erasure. All cells 
within the selected block are simultaneously erased via 
Fowler-Nordheim tunneling. Applying 12V to block 
source junctions and grounding the control gates erases 
all cells within that block. The internal WSM controls 
the automated block-erase algorithm, including pre- 
erase conditioning (i.e., pre-programming all block bits) 
and margin verification, in response to user requests 
relayed by the CUI. WSM-controlled block erasure, in- 
cluding pre-programming, typically requires 1.6 sec- 
onds. 


Byte write is accomplished with the standard EPROM 
mechanism of channel hot-electron injection from the 
cell drain junction to the floating gate. Bringing both 
the control gate and the cell drain to high voltage initi- 
ates programming. The WSM regulates the internal 
byte-write algorithm, including margin verification, af- 
ter the correct command sequence is written and de- 
coded. Byte write typically requires 9 ps. 
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Figure 1. ETOX Flash Memory Cell 
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DEVICE ARCHITECTURE 


Array Organization 


The 28FOO8SA is a 1,048,576 x 8 memory comprised of 
2048 rows by 8192 columns. Array layout is segmented 
as four quadrants, each 1024 rows by 2048 columns. 
Access time is reduced by limiting column length to 
1024 cells. The polysilicon row is strapped in metal 
every 512 columns to reduce wordline delay. Two row 
decoders run vertically between quadrants, and column 
decoders run horizontally between quadrants. Figure 2 
shows block placement and array organization. A die 
photo of the chip is shown in Figure 30. 


Each quadrant is subdivided into four 64-Kbyte blocks. 
Each block source is electrically isolated from the 
source of other blocks. This allows individual block 
_ erase without altering data in the remaining 15 blocks. 


Each block is further subdivided into eight Input/Out- 
puts. Data for I/Op is stored in the left-most 64 col- 
umns, with the next 64 storing data for I/O}, etc. 


Rows in the upper quadrants are numbered 0-1023 
from top to bottom; lower quadrant rows similarly 
1024-2047. 
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Addresses Ag—Apg select one of 1024 rows. while Ajg 
selects upper or lower decoder. Row address lines are 
decoded sequentially for selection. Row address bit- 
maps are listed in Table 3. 


Columns are numbered 0-8191 from left to right, top 
to bottom. Addresses A;9—Aj 6 select one of 16 blocks, 
while A;5—Ayjo select eight of the 512 columns within 
that block. These ten address lines are also decoded 
sequentially to access all 8192 columns. Block address 
bitmaps are listed in Table 4; column address bitmaps 
are listed in Table 5. 


Write/Erase Automation 


Intel’s 28FOO8SA contains an on-chip Command User 
Interface, Write State Machine, Status Register, and 
address/data latches to dramatically simplify user in- 
terface. This combination of functional units reduces 
microprocessor control complexity of byte-write, block- 
erase, erasSe-suspend/resume, Status Register read/ 
clear, ID read, and array read operations. Figure 3 
shows the 28FOO8SA block diagram. 
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Figure 2. 28FO008SA Block Placement and Array Organization 
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Command User Interface (CUI) 


The CUI consists of a command decoder and command 
register. User requests are decoded and latched in a 
microprocessor write cycle controlled by Chip Enable 
(CE#) and Write Enable (WE#). Status Register 
read/clear, ID read, and array read commands are di- 
rectly handled by the CUI. The CUI also accepts byte- 
write, block-erase, and erase-suspend/resume com- 
mands. WE#’s rising edge latches address, command 
and data-in registers, and requests WSM initiation of 
the selected operation. These on-chip address, com- 
mand, and data latches controlled by the CUI minimize 
system interface logic, and free the system bus. 


Write State Machine (WSM) 


The WSM processes byte-write, block-erase, and erase- 
suspend/resume requests received from the CUI. The 
WSM rejects byte-write and block-erase requests if the 
WSM is currently busy, if Vpp is not at high voltage 
(12V), or if the Low Vpp Status Register flag is set (i.e., 
not cleared from a previous low-voltage condition). 


OUTPUT 
BUFFER 


IDENTIFIER 
REGISTER 


OUTPUT 
MULTIPLEXE 


Ap - Aig 


INPUT Y-DECODER 
BUFFER iy 
ADDRESS 


ADDRESS 
COUNTER 


I 
DATA 
REGISTER 


64-KBYTE 
BLOCKS 


a 

intel. 
The WSM consists of an integrated oscillator and con- 
trol circuitry. It generates signals which control the 
byte-write, block-erase, erase-suspend/resume, and ver- 
ify circuits. It also receives feedback from these circuits 
allowing Status Register update. The WSM and associ- 
ated circuits perform the equivalent of first-generation 
flash memory program and bulk-erase algorithms auto- 
matically. This eliminates the need for system timers, 
and frees the microprocessor to service interrupts or 


perform other functions during device byte-write or 
block-erase operations. 


The WSM provides feedback to the CUI to determine 
when a given command is valid. Although nearly all 
commands are available when the WSM is inactive, 
only status read is valid while the WSM performs a 
byte-write operation. During block erase, only the read- 
status and erase-suspend commands are available. 
Read-array, read-status, and erase-resume commands 
are valid with the WSM in an erase-suspended state. 
Invalid operations are interpreted as the read-array 
command when the WSM is inactive or erase-suspend- 
ed, and as the read-status command when the WSM is 
active in byte write or block erase. 
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Figure 3. 28FO08SA Block Diagram 
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Status Register 


The internal Status Register contains a full complement 
of activity status bits. These bits and their meaning 
(1,0) are: 


SR.7: WSM status (READY/BUSY) 


SR.6: Erase-suspend status (ERASE SUSPENDED/ 
ERASE IN PROGRESS OR COMPLETED) 


SR.5: Block-erase status (ERROR/SUCCESS) 
SR.4: Byte-write status (ERROR/SUCCESS) 
SR.3: Vpp status (LOW/OK) 


All bits are set by the WSM, and read via the CUI. The 
WSM can only set SR.3, SR.4, and SR.5; it cannot 
clear them. They remain set until the CUI processes a 
clear Status Register command. There are two reasons 
for operating in this fashion. 


First is synchronization; the WSM does not know when 
the host CPU has read the Status Register, therefore 
does not know when to clear it. 


Secondly, allowing system software to control reset 
adds flexibility to the way this device may be used. The 
CPU may write several bytes or erase several blocks 
back-to-back while monitoring RY/BY# or polling 
SR.7 to determine when the next byte-write or block- 
erase command can be given. When all bytes are writ- 
ten, or all blocks erased, the system polls the other 
status flags to determine if all operations were success- 
ful or if an error occurred. While other approaches re- 
quire the controlling microprocessor to watch for non- 
completion of write or erase within a specified time to 
indicate an error, this implementation requires no ex- 
ternal system timers or software timing loops. As such, 
the system can reduce its polling overhead while still 
identifying any potential error conditions. 


Status Register contents are driven to device outputs on 
the falling edge of CE# or Output Enable (OE#), 
whichever occurs last in the read cycle. CE# or OE# 
must be toggled to update Status Register contents. 


Ready/Busy Indication (RY/BY #) 


A dedicated output pin, RY/BY #, provides additional 
indication of WSM activity. This capability allows both 
hardware signal of status and/or software polling to 
determine activation, completion, or suspension of in- 
ternal byte-write/block-erase operations. Hardware sig- 
naling minimizes both CPU overhead and system pow- 
er consumption. 
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internal Oscillator 


The WSM is designed using clocked logic circuits. An 
on-chip ring oscillator generates the clock signals. The 
frequency of a standard ring oscillator varies with pro- 
cessing, temperature and supply voltage. An improved 
design, used on the 28FOO1BX and 28FO08SA, mini- 
mizes these variations. | 


The switching current of each stage in the ring oscilla- 
tor is controlled by a current reference which varies 
linearly with Vcc. The trip point of each ring oscillator 
inverter also varies linearly with Voc. These two effects 
offset each other, and the resulting oscillator period is 
proportional to RC with only a small dependence on 


Vcc. 


An on-chip resistor sets the value of R. The gate capac- 
itance of the inverters in the ring oscillator sets the 
value of C. Process variations in these values are re- 
duced by trimming the period of each oscillator during 
manufacturing. The resistor is the only source of tem- 
perature variation. 


Supply Voltage Sensing 


The LOWVcc and LOWVpp generation circuit is 
shown in Figure 4. Power supply voltages (Vcc and 
Vpp) are divided down and compared to a reference 
voltage. If Vppp is greater than the divided power sup- 
ply voltage, the LOWVcc or LOWV pp signal is driven 
high. The generated Vppr level is supply-voltage inde- 
pendent to the first order. 


Positive power to the circuit is supplied by M1 and M2. 
M1 and M2 sources are pulled up to the higher of (Vpp 
— Vin) or (Vcc — Viw)- Vin is the threshold of an 
implanted N-channel device, about 0.9V. Viy is the 
threshold of a native N-channel device, about OV. This 
scheme ensures that the circuit works regardless of the 
applied supply voltages. 


VOLTAGE 
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Figure 4. Low Power Detector Circuit 
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The LOWVcc signal is used by the byte-write and 
block-erase circuits, as well as the CUI and WSM. If 
LOWV cc is active, the CUI will not accept user writes 
and resets to an array read condition. The WSM is 
similarly reset by LOWVcc. The LOWVpp signal is 
used by the WSM;; if Vpp drops below the high-voltage 
detector trip point during byte write or block erase, the 
Status Register’s low Vpp bit is set and WSM operation 
halts. The system must clear the Status Register before 
any subsequent byte-write or block-erase operations 
can succeed. 


Reset/Power-Down 


The 28FO08SA incorporates a deep power-down mode 
that reduces Icc and Ipp to typically 0.20 wA and 
0.10 A respectively. RP# low selects deep power- 
down mode. When RP# is high, the device can be 
placed in an active or standby mode depending on 
CE #’s state. 


Deep power-down is similar to standby except that all 
circuits excluding the RP# buffer are turned off. This 
mode greatly reduces power consumption, but requires 
more time to transition the device into an active mode. 
A read wake-up time (tpygy) is required from RP# 
switching high until output and sense circuitry become 
fully functional and data can be read from the part. 
Similarly, a write wake-up time (tpyywz) is needed be- 
fore the CUI recognizes writes. After this interval, nor- 
mal operation is restored; the CUI is reset to read-array 
mode and the Status Register is cleared to 80H. 


A diagram of the power-down circuit is shown in Fig- 
ure 5. The TTL buffer formed by M1-—M3 disables the 
low-power detect circuits, the redundancy-address flash 
bits, and the CE# TTL buffer formed by M4-—M6. In 
previous Intel flash devices, these circuits were always 
enabled. Turn-on delays of these circuits determine 
RP# access time and write specifications. 


RP# functions properly with TTL-level inputs. How- 
ever, to attain lowest possible power consumption, full 
CMOS levels must be used. If the voltage on the gate of 
M3 rises above its 0.9V threshold M3 will turn on and 
draw current. Input voltages in the 0.7V-—0.9V range 
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could cause enough subthreshold conduction in M3 to 
exceed the Icc deep power-down current (Iccp) speci- 
fication. This is why RP #’s input voltage is specified as 
GND +0.2V. 


RP# also functions as a hardware reset to the WSM 
and CUI. If RP# is driven active during byte-write, 
block-erase, or erase-suspend operation, that operation 
is aborted leaving the addressed memory locations in an 
unknown state. The Status Register is cleared, and CUI 
is set to array read. The aborted operation (byte write 
or block erase) must be repeated with RP# inactive to 
obtain a valid condition in the memory array. 


Reset using RP# should be restricted to system reset 
only (as in the case of power supply failure), and should 
not be used as a software means to terminate byte-write 
or block-erase operations. 
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Figure 5. Power-Down and Reset Functions 
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Figure 6. Array Erase Blocking 


Block Erase 


Block erasure is achieved by a two-step write sequence. 
The erase-setup code is written to the CUI in the first 
cycle. Erase confirm is written in the second cycle. The 
address supplied with the erase-confirm command is 
latched and decoded internally by the 28FOO8SA; erase 
is subsequently enabled in that block. The second 
WE# rising edge initiates the operation (WE#- 
controlled write). 


The WSM triggers the high-voltage flash-erase switch 
connecting the 12V supply to the source of all bits in 
the specified block, while all wordlines are grounded. 
Figure 6 shows organization of the block source 
switches. Fowler-Nordheim tunneling results in simul- 
taneous erasure of all bits in the selected block. 


The block source switch controls the source voltage of 
all bits in a particular block. This circuit is shown in 
Figure 7. During block erase, M2 is off and M1 pulls 
the source to Vpp. When not in erase, M1 is off and M2 


pulls the source to ground. The high-voltage latch 
formed by M4—M7 converts the low-voltage ERASE 
signal to a high-voltage signal that controls M1. 


The tunneling that occurs during block erase requires 
only a small amount of current. However, the initial 
current required to charge the block’s large source ca- 
pacitance to the erase voltage is significant. M1 is sized 
to limit this current yet still apply sufficient source volt- 
age to achieve fast block-erase time. 


The LOWV¢cc¢ signal protects the array from erasure 
when Vpp is at a high voltage but Vcc is below the 
write/erase lockout voltage (V, Ko). When this occurs, 
M3 pulls the block source to ground. The high-voltage 
latch is forced by M8 into the state that turns M1 off. 


Vpp is continually monitored during all phases of the 
block-erase operation. If Vpp falls below the trip point 
of its high-voltage detect circuitry, erasure will not oc- 
cur (or halts) and Status Register Vpp status (SR.3), 
block-erase status (SR.5) and WSM status (SR.7) bits 
are set to “1”, 


BLOCK 
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Figure 7. Block Source Switch 
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If SR.3 (Low Vpp) is set, WSM operation is inhibited. 
The WSM will not execute further byte-write or block- 
erasure sequences until the Status Register has been 
reset by system software. Byte-write or block-erase re- 
quests with error flags SR.4 or SR.5 set are not inhibit- 
ed, but the system loses the ability to determine success. 
The clear Status Register command resets these bits. 


After receiving the block-erase command sequence, the 
WSM automatically controls block pre-condition (pro- 
gramming all bytes to OOH within the chosen block), 
erase pulses and pulse repetition, timeout delays, and 
byte-by-byte verification of all block addresses (sequen- 
tially checked via the address counter) using an alterna- 
tive sensing reference to verify margin. The internal 
erase and verify operations continue until the entire 
block is erased. A read cycle applied to the part follow- 
ing the block-erase command sequence outputs Status 
Register contents; system software can poll the Status 
Register to determine when block erase is complete, 
and if it was successful. Alternately, the system can 
monitor RY/BY # until that output is driven high, and 
then poll the Status Register to determine success. Fol- 
lowing block erasure, the device remains in Status Reg- 
ister read mode; a read-array command must be written 
to the device to access array data. 


If the erase-setup command is followed with a com- 
mand other than erase confirm, the device will not 
erase. The WSM sets both byte-write status and block- 
erase status bits in the Status Register to indicate an 
invalid sequence. 


Erase Suspend/Resume 


Erase suspend allows the system to interrupt block 
erase to read data from another array block. The ability 
to suspend erase and read data from another block of- 
fers the flexibility required for file system applications. 
Upon receiving the erase-suspend command, the CUI 
requests that the WSM pause at one of several predeter- 
mined points in the algorithm. Upon reaching a sus- 
pend point, the WSM sets SR.6 (erase-suspend status) 
and SR.7 to “1”, and drives the RY/BY# pin high. 
The system must poll the Status Register to determine 
if the suspend has been processed or the block erase has 
actually completed. Block-erase completion is indicated 
by SR.6 cleared to “0” and SR.7 set to “1”. Read bus 
cycles default to Status Register read after issuing the 
erase-suspend command. 
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Once suspended, the WSM asserts a signal to the CUI 
which allows response to the read-array, read-status, 
and erase-resume commands. The system can write the 
read-array command allowing read access to blocks 
other than that which is suspended. The WSM contin- 
ues to run idling in a suspended state, regardless of all 
control inputs except RP#. RP# driven low immedi- 
ately shuts down the WSM, aborting the suspended 
erase operation. 


The erase-resume command must be issued upon com- 
pletion of reads from other array blocks to continue 
block-erase operation. The WSM then clears SR.6 and 
SR.7, drives RY/BY # low, and resumes erase opera- 
tion from the suspension point. Read cycles following 
the erase-resume command output Status Register 
data. 


Byte Write 


Byte write follows a flow similar to block erase. The 
byte-write setup command is first written to the CUI. A 
second write cycle loads address and data latches. The 
rising edge of the second WE# pulse requests that the 
WSM initiate activity, applying high voltage to the 
gates and drains of all bits to be written. Unlike block 
erase, byte write will proceed regardless of what data is 
applied on the second CUI write cycle; however, apply- 
ing data FFH does not modify memory contents. 


Like block erase, the WSM controls program pulses 
and pulse repetition, timeout delays and byte verifica- 
tion. Byte write and verify (with alternate sensing refer- 
ence and internally-generated verify voltage) continue 
until the byte is written. Internal byte-write verify 
checks that all bits written to zero have been correctly 
modified; it does not check bits specified as one. Byte 
write cannot change existing zeros to ones; this can 
only be accomplished by erase. 


Read bus cycles following byte write operations output 
Status Register data. System software, polling the 
Status Register, is informed of status through bits SR.3, 
SR.4, and SR.7. The RY/BY# output can also be 
monitored to determine completion. The read-array 
command must be written to the CUI following byte 
write to access array data. 


In a scenario similar to that described under block era- 
sure, byte write does not occur (or halts) if Vpp is de- 
tected low. In such a case SR.3, SR.4, and SR.7 are set 
high, and no further writes can take place until the 
Status Register is cleared by the clear Status Register 
command. 
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AC and DC Parameters 


Figures 9 through 24 show graphs of several device 
parameters as a function of temperature and supply 
voltage. The graphs illustrate that the 28FOO8SA has 
significant margin to data sheet specifications. 


In particular, note Figure 9 which shows typical read 
performance tavqv (tacc) of the 28FOO8SA as a func- 
tion of Vcc and ambient temperature. ter gy (tcg) in 
Figure 10 and tgrov (tog) in Figure 11 are also of 
particular interest. Access times taygy, tELav, and 
tGLov are specified and tested with an output load of 
100 pF; additional output load capacitance slows device 
operation. 


Table 1 shows typical supply currents at room tempera- 
ture for several operating modes. 


Table 1. RMS Current Values 


(Vcc = 5.0V, 
CMOS Inputs) 


Energy/Power Consumption 


The system designer is primarily concerned with power 
consumption during block erase and byte write. Typical 
curves for Icc and Ipp during block erase are shown in 
Figure 25. Icc and Ipp for byte write are illustrated in 
Figure 26. 


Byte-Write/Block-Erase Times 


The 28FOO8SA advances byte-write and block-erase 
performance compared to previous flash memories. The 
on-chip algorithm is improved over the 28FO01BX to 
take advantage of process enhancements. This improve- 
ment is most apparent when compared to first-genera- 
tion flash parts with externally controlled algorithms. 
First-generation device times shown in Table 2 assume 
optimal system overhead, and as such are absolute best 
case. 
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Table 2. Byte-Write and Block-Erase 
Performance vs Previous Devices 


Byte-Write| Block-Erase |Erase Time 
Time /|Time/# Bytes; per Kbyte 
Second-Generation Flash Memory Devices(1) 


1.5s/64K 
3.88/112K 
2.1s/8K 
2.1s/4K 


pero10 | 165ys | 990/128 | a0ms 
parases | 165 ys | 160/92 | St ms 


NOTES: 

1. Typical measured time. 

2. Times calculated based on typical erase and precondi-. 
tion pulse requirements, with minimum write timings. Calcu- 
lations are described in Figure 8. 


Figure 27 shows block-write and block-erase times at 
0°C and 70°C over cycling. 


DEVICE RELIABILITY 


Byte-Write/Block-Erase Cycling 


One of the most important reliability aspects of the 
28FO08SA is its capability of 100,000 write/erase cycles 
per block. Destructive oxide breakdown has been a lim- 
iting factor in extended cycling of thin-oxide 
EEPROMs. Intel’s ETOX III flash memory technolo- 
gy extends cycling performance through: 


© Improved tunnel-oxide processing that increases 
charge-carrying capability tenfold. 

e Significantly reduced oxide area under stress that 
minimizes probability of oxide defects in the region. 


@ Reduced oxide stress due to a lower peak electric 
field (lower erase voltage than EEPROM). 


Reliable byte-write/block-erase cycling requires proper 
selection of the maximum erase threshold voltage (V;), 
and maintenance of a tight distribution. Maximum 
erase V; is set to 3.4V via the internal block-erase algo- 
rithm and verify circuits. Tight erase V; distribution 
gives an order of magnitude of erase-time margin to the 
fastest erasing cell, with virtually identical erase V; dis- 
tributions at 1 and 10,000 cycles (Figure 28). Program 
V; distribution is similarly consistent over cycling (Fig- 
ure 29). 
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28FOO8SA array architecture enhances cycling capabil- 
ity by reducing gate disturb conditions on cells in unre- 
lated blocks during byte write and erase pre-condition- 
ing. First, only one of the two row decoders is active at 
any time (selected by Ajg). Rows in the other two 
quadrants are grounded. Secondly, two separate inter- 
nally-switched voltages supply the left and right quad- 
rants. Only one supply (selected by block address Aj;g) 
is switched to programming voltages while the other 
remains at read voltages. This Ajg—Ajg row decoding 
ensures that during byte write, 12 of the 16 blocks have 
a gate voltage below that required for programming. 


Data Protection 


The 28FO08SA offers protection against accidental 
block erasure or byte write during power transitions. 
Internal circuitry creates a device insensitive to Vpp/ 
Vcc supply power-up sequencing. Vpp < Vppy locks 
out byte-write and block-erase circuits. Vcc < VLKo 
disables CUI command writes, resets the CUI to array 
read mode, and holds the WSM inactive. The system 
designer must still guard against spurious command 
writes for Vcc > ViKo when Vpp > Vppy. 


Several strategies are available to prevent data modifi- 
cation in the 28FO08SA. The CUI provides a degree of 
software write protection since memory alteration oc- 
curs only after successful completion of a two-step 
write sequence. WE# and CE# must both go active to 
perform this sequence; driving either high inhibits com- 
mand/data writes. Secondly, the system can place the 
device in deep power-down mode (RP# = Vj) to 
disable command writes, reset the CUI to array read 
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mode, and hold the WSM inactive, effectively protect- 
ing array data. Finally, the system designer may hard- 
wire Vpp to Vppy, or switch it to Vppy only when 
memory updates are required. Since byte-write and 
block-erase circuits are disabled by Vpp < Vpp,, Vpp 
switching adds another level of data security. 


SUMMARY 


The 28FO08SA is the first flash memory with features 
optimized for solid-state systems and file storage. These 
features include symmetrical block-erase, automation 
of byte write and block erase, erase suspend for data 
read, a reset/power-down mode, a write/erase Status 
Register, and a dedicated RY/BY# status pin. With 
simple microprocessor interfacing and software com- 
mand sequences, the 28FOO8SA is the non-volatile stor- 
age solution of choice for today’s designs. 


OTHER REFERENCES 


Related documents of interest to readers of this engi- 
neering report: 
28FO008SA Data Sheet (order #290429) 


28FO08SA-L Data Sheet (order #290435) 


AP-359 “28FOO08SA Hardware Interfacing” 
(order #292094) 


AP-360 “28FO08SA Software Drivers” 
(order #292095) 


AP-364 ‘“28FO08SA Automation and Algorithms” 
(order #292099) 


“ETOX III Flash Memory Technology” (or- 
der #294012) 
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SUPPLEMENTARY INFORMATION 


FORMULA: 

b = # bytes in a block (256K, 128K, 64K, 32K) 
n = # of erase pulses required (90 pulses) 

w = time for a write cycle (150 ns, tayay) 


v = time to verify (6055 ns, twHGL + tGLev) 


p = program pulse width (10 pws, twHwHi) one 
pulse programming assumed 


= 
o 
c 
~ 
S 
> 
e 


e = erase pulse width (10 ms, twHwuH?) 


Precondition and precondition verify time is: 
b (2w + p + v) 


Erase/verify, each loop where some byte does not 
pass verify: 
(n — 1) (2w + e+ v) 


Last erase pulse: 294011-8 


(1) (2w + e) 
Figure 9. tayqv (tacc) VS Vcc and Temperature 
Passing erase-verify, all bytes: 

b (w + v) 


Total time can be summarized as: 
b(83w + p + 2v) + n(2w + e + v) — (v) 


or substituting in times for write, verify, program 
and erase pulse widths: 
b (22.56 x 10-6) + n (10.006355 x 10-3) 
— (6.055 x 10-6) Seconds 


Figure 8. Erase Time Calculations for 
First-Generation Flash Memories 


teLov (ns) 


294011-9 


294011-10 


10. t t Vv nd Temperature 
Figure 10. teLav (tce) vs Vec a P Figure 11. te_av (toe) vs Vcc and Temperature 
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Figure 12. topywu (tps WE #) Figure 13. teypx (tpH CE #) 
vs Vcc and Temperature vs Vcc and Temperature 


tavwH (ns) 


twHax (ns) 


294011-13 


294011-14 


Figure 14. taywu (tas WE #) Figure 15. twHax (tan WE #) 
vs Vcc and Temperature ‘vs Voc and Temperature 
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Figure 16. taveH (tas CE#) vs Figure 17. tanex (tan CE#) 
Vcc and Temperature vs Vcc and Temperature 


twuowH (ns) 


10 ns IS LIMIT 
OF MEASUREMENT 
HARDWARE 
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Figure 18. twLwu (twp) Figure 19. twHri VS Vcc and Temperature 
vs Vcc and Temperature 
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294011-19 294011-20 


Figure 20. Dynamic Vj, Figure 21. Dynamic Viy 
vs Vcc and Temperature vs Vcc and Temperature 
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Figure 22. Iloy TTL vs Vcc and Temperature Figure 23. lo4 CMOS vs Vcc and Temperature 
(Von = 2.4V) (Von = Vec — 0.4V) 
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Figure 24. lo. vS Vcc and Temperature 
(VoL = 0.45V) 
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200 ms/DIV 
294011-25 


Figure 25. Icc and Ipp under Block-Erase Operation 
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Figure 26. Icc and Ipp under Byte-Write Operation 
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Figure 27. Write and Erase Times vs Cycling 
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CYCLING 
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CYCLING 


6.0 6.5 7.0 294011-30 


Figure 29. Program V; vs Cycles 
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Figure 30. 278FO08SA Die Photo 
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pt Ay 9 
—TI—I A, ; Pin Names 


tt Ay, Ao-A1g Address Inputs 
Ld A,s DQ o-DQ7 Data Inputs/Outputs 
PoP Are CE# Chip Enable 
ak RP# Reset/Power-Down 
as ttl Avs OE # Output Enable 
10 44LEAD PSOP IT Ayo WE # Write Enable 
41 0-525" x 1.110" Nc RY/BY # Ready/Busy 
ye Lemna Vpp Write/Erase Power Supply 
Device Power Supply 


oN OO eF WA BS 


13 TTI Nc Voc 
GND Ground 


14 [ty NC 

15 | ett} WWE# 

16 YT OEF 

7 IT _j RY /BY# 
18 [TT] da, 

19 CL) Dos 


20 mt a DQ, 
Z1 pee — 3] DQ, 
22 ies 2 oe) Voc 


294011-32 


Figure 31. PSOP Lead Configuration 
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Standard Pinout 


STANDARD PINOUT 
E28FOO8SA . 
40 LEAD TSOP 
10mm x 20mm 
TOP VIEW 


Reverse Pinout 


q 


REVERSE PINOUT 
F28FOO8SA 
40 LEAD TSOP 
10mm x 20mm 
TOP VIEW 


OnN Ont WH - 


wo 


ee ee ee ee ee ee ee ee 
OOnN OU FP WHY — CO 
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Figure 32. TSOP Lead Configuration 
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Wordlines are numbered sequentially from top to bottom. Addresses Ag—Ag sequentially decode wordlines: block 
address Ajg9 selects between upper and lower row-decoder. Wordlines 0— 1023 serve the left and right quadrants at 
top of device; 1024-2047 serve the lower quadrants. 


Table 3. Row Address Bitmap 


a | 


-|+ 
-|e]°|- 
ef- 


-le 
—- a 
a a" 
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Blocks are numbered sequentially right to left, top to bottom. Columns within a block are numbered left to right. 
I/Os within a block are numbered from 0-7 left to right. 


Table 4. Block Address Bitmap 


1024-1535 
1536-2047 
2048-2559 
2560-3071 
3072-3583 


3584095 
4096-4607 
4608-5119 
5120-5631 
5632-6143 
6144-6655 


Columns are numbered from left to right across the top quadrants, and left to right across the bottom quadrants. 
Addresses A;5—Aj9 sequentially count columns. Columns are listed for block 0; other blocks are counted similarly. 


Table 5. Column Address Bitmap 


1/0 
64 


: 
w+ssc0c0/P 
w+s0-+00/F 
-oro-o+0/P 
BBs row ol5 


+ +00000|F 
-++00000/F 


—~—-—-@e8 OoO0 0 OO 


REVISION HISTORY 
-002 — Renamed PWD as RP# to match JEDEC conventions. 
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Intel 28FOO8SA FlashFile” Memory Evaluation 
Module D, FLASHEVAL4 Product Brief 


‘Kit @ 28F008SA Adapter Board with: 
Contents §_@ 40-ld TSOP socket 
(‘E’, standard pinout) 
@ 40-ld TSOP socket 
(‘F’, reverse pinout) 
@ 44-ld PSOP socket 


@ 5.25” floppy disk with iFlash2 
Software (Version 2.4) 


@ Technical documentation 
describing Intel’s 28F008SA 
FlashFile™ Memory 


@ Flash Memory Evaluation Kit II 
Installation Guide and User’s 
Manual with 28F008SA Adapter 
Board installation instructions 


@ Manual vacuum wand 


@ Registration card 


Intel’s 28FO08SA FlashFile™ Memory Evaluation Module provides system 
designers with a cost-effective prototyping tool for writing and erasing 

the 2SFOO8SA FlashFile Memory. This evaluation module is a hardware 
adapter board upgrade to the Intel Flash Memory Evaluation Kit Il 

(D, FLASHEVAL2) which supports the 28FOO8SA in 40-lead TSOP 
(standard and reverse pinouts) and 44-lead PSOP packages. 


Kit Description 


The 28FO08SA Evaluation Module, used with Intel’s Flash Memory Evaluation Kit, 
provides the hardware, software and system interface necessary to evaluate and 
integrate Intel’s 8Mbit Flash Memory into your next design. 


The module provides instructions to install the 28FOO8SA adapter board. Technical 
documentation includes 28FO0O8SA datasheets, engineering reports and application 
notes. Together, they provide a complete description of the technology and 
important design considerations. 


FlashFile is a trademark of Intel Corporation 
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ADVANCE INFORMATION 


28F400BX-T/B, 28F004BX-T/B 
4 MBIT (256K x16, 512K x8) BOOT BLOCK FLASH 
MEMORY FAMILY 


x8/x16 Input/Output Architecture 

— 28F400BX-T, 28F400BX-B 

— For High Performance and High 
integration 16-bit and 32-bit CPUs 


x8-only Input/Output Architecture 

— 28F004BX-T, 28F004BX-B 

— For Space Constrained 8-bit 
Applications 


Optimized High Density Blocked | 
Architecture 

— One 16-KB Protected Boot Block 
— Two 8-KB Parameter Blocks 

— One 96-KB Main Block 

— Three 128-KB Main Blocks 

— Top or Bottom Boot Locations 


Extended Cycling Capability 
— 100,000 Biock Erase Cycles 


Automated Word/Byte Write and Block 
Erase 

— Command User Interface 

— Status Registers 

— Erase Suspend Capability 


SRAM-Compatible Write Interface 


Automatic Power Savings Feature 
— 1 mA Typical Icc Active Current in 
Static Operation 


October 1993 


Order Number: 290451-003 


@ Very High-Performance Read 


— 60/80 ns Maximum Access Time 

— 30/40 ns Maximum Output Enable 
Time 

Low Power Consumption 

— 20 mA Typical x8 Active Read 
Current 

— 25 mA Typical x16 Active Read 
Current 


Reset/Deep Power-Down Input 
— 0.2 vA Icc Typical 
— Acts as Reset for Boot Operations 


Extended Temperature Operation 
— —40°C to + 85°C 


Write Protection for Boot Block 


Hardware Data Protection Feature 
— Erase/Write Lockout During Power 
Transitions 


Industry Standard Surface Mount 
Packaging 
— 28F400BX: JEDEC ROM Compatible 
44-Lead PSOP 
56-Lead TSOP 
— 28F004BX: 40-Lead TSOP 


12V Word/Byte Write and Block Erase 
—Vpp = 12V +5% Standard 
—Vpp = 12V +10% Option 


ETOX Ill Flash Technology 
— 5V Read 
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Intel’s 4-Mbit Flash Memory Family is an extension of the Boot Block Architecture which includes block-selec- 
tive erasure, automated write and erase operations and standard microprocessor interface. The 4-Mbit Flash 
Memory Family enhances the Boot Block Architecture by adding more density and blocks, x8/x16 input/out- 
put control, very high speed, low power, an industry standard ROM compatible pinout and surface mount 
packaging. The 4-Mbit flash family is an easy upgrade from Intel’s 2-Mbit Boot Block Flash Memory Family. 


The Intel 28F400BX-T/B are 16-bit wide flash memory offerings. These high density flash memories provide 
user selectable bus operation for either 8-bit or 16-bit applications. The 28F400BX-T and 28F400BX-B are 
4,194,304-bit non-volatile memories organized as either 524,288 bytes or 262,144 words of information. They 
are offered in 44-Lead plastic SOP and 56-Lead TSOP packages. The x8/x16 pinout conforms to the industry 
standard ROM/EPROM pinout. 


The Intel 28FO004BX-T/B are 8-bit wide flash memories with 4,194,304 bits organized as 524,288 bytes of 
information. They are offered in a 40-Lead TSOP package, which is ideal for space-constrained portable 
systems. 


These devices use an integrated Command User Interface (CUI) and Write State Machine (WSM) for simplified 
word/byte write and block erasure. The 28F400BX-T/28F004BX-T provide block locations compatible with 
Intel’s MCS-186 family, 80286, i386™, i486™, i860™ and 80960CA microprocessors. The 28F400BX-B/ 
28F004BX-B provide compatibility with Intel’s BO960KX and 80960SX families as well as other embedded 
microprocessors. 


The boot block includes a data protection feature to protect the boot code in critical applications. With a 
maximum access time of 60 ns, these 4-Mbit flash devices are very high performance memories which 
interface at zero-wait-state to a wide range of microprocessors and microcontrollers. A deep power-down 
mode lowers the total Vcc power consumption to 1 uwW. This is critical in handheld battery powered systems. 
For very low power applications using a 3.3V supply, refer to the Intel 28F400BX-TL/BL, 28F004BX-TL/BL 4- 
Mbit Boot Block Flash Memory Family datasheet. 


Manufactured on Intel’s 0.8 micron ETOX Ill process, the 4-Mbit flash memory family provides world class 
quality, reliability and cost-effectiveness at the 4-Mbit density level. 
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1.0 PRODUCT FAMILY OVERVIEW 


Throughout this datasheet the 28F400BxX refers to 
both the 28F400BX-T and 28F400BX-B devices and 
28F004BX refers to both the 28F004BX-T and 
28F004BX-B devices. The 4-Mbit flash memory fam- 
ily refers to both the 28F400BX and 28F004BxX prod- 
ucts. This datasheet comprises the specifications for 
four separate products in the 4-Mbit flash memory 
family. Section 1 provides an overview of the 4-Mbit 
flash memory family including applications, pinouts 
and pin descriptions. Sections 2 and 3 describe in 
detail the specific memory organizations for the 
28F400BX and 28F004BX products respectively. 
Section 4 combines a description of the family’s 
principles of operations. Finally Section 5 describes 
the family’s operating specifications. 


Product Family 


X8/X16 Products X8-Only Products 
28F400BX-T 28F004BX-T 
28F400BX-B 28F004BX-B 


1.1 Main Features 


The 28F400BX/28F004BxX boot block flash memory 
family is a very high performance 4-Mbit (4,194,304 
bit) memory family organized as either 256 KWords 
(262,144 words) of 16 bits each or 512 Kbytes 
(524,288 bytes) of 8 bits each. 


Seven Separately Erasable Blocks including a 
Hardware-Lockable boot block (16,384 Bytes), 
Two parameter blocks (8,192 Bytes each) and 
Four main blocks (1 block of 98,304 Bytes and 3 
blocks of 131,072 Bytes) are included on the 4-Mbit 
family. An erase operation erases one of the main 
blocks in typically 2.4 seconds and the boot or pa- 
rameter blocks in typically 1.0 seconds independent 
of the remaining blocks. Each block can be indepen- 
dently erased and programmed 100,000 times. 


The Boot Block is located at either the top 
(28F400BX-T, 28F004BX-T) or the bottom 
(28F400BX-B, 28F004BX-B) of the address map in 
order to accommodate different microprocessor pro- 
tocols for boot code location. The hardware locka- 
ble boot block provides the most secure code stor- 
age. The boot block is intended to store the kernel 
code required for booting-up a system. When the 
RP # pin is between 11.4V and 12.6V the boot block 
is unlocked and program and erase operations can 
be performed. When the RP # pin is at or below 6.5V 
the boot block is locked and program and erase op- 
erations to the boot block are ignored. 


The 28F400BX products are available in the ROM/ 
EPROM compatible pinout and housed in the 
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44-Lead PSOP (Plastic Small Outline) package and 
the 56-Lead TSOP (Thin Small Outline, 1.2mm thick) 
package as shown in Figures 3 and 4. The 
28F004BX products are available in the 40-Lead 
TSOP (1.2mm thick) package as shown in Figure 5. 


The Command User Interface (CUI) serves as the 
interface between the microprocessor or microcon- 
troller and the internal operation of the 28F400BX 
and 28F004BX flash memory products. 


Program and Erase Automation allows program 
and erase operations to be executed using a two- 
write command sequence to the CUI. The internal 
Write State Machine (WSM) automatically executes 
the algorithms and timings necessary for program 
and erase operations, including verifications, there- 
by unburdening the microprocessor or microcontrol- 
ler. Writing of memory data is performed in word or 
byte increments for the 28F400BX family and in byte 
increments for the 28F004BX family typically within 
9 ps which is a 100% improvement over current 
flash memory products. 


The Status Register (SR) indicates the status of the 
WSM and whether the WSM successfully completed 
the desired program or erase operation. 


Maximum Access Time of 60 ns (TACC) is achieved 
over the commercial temperature range (0°C to 
70°C), 5% Voc supply voltage range (4.75V to 
5.25V) and 30 pF output load. Maximum Access 
Time of 70 ns (TACC) is achieved over the commer- 
cial temperature range, 10% Voc supply range (4.5V 
to 5.5V) and 100 pF output load. 


Ipp maximum Program current is 40 mA for x16 
operation and 30 mA for x8 operation. Ipp Erase 
current is 30 mA maximum. Vpp erase and pro- 
gramming voltage is 11.4V to 12.6V (Vpp = 12V 
+ 5%) under all operating conditions. As an op- 
tion, Vpp can also vary between 10.8V to 13.2V (Vpp 
= 12V + 10%) with a guaranteed number of 100 
block erase cycles. 


Typical Icc Active Current of 25 mA is achieved 
for the X16 products (28F400BX). Typical Icc Ac- 
tive Current of 20 mA is achieved for the X8 prod- 
ucts (28F400BX, 28F004BxX). Refer to the Icc active 
current derating curves in this datasheet. 


The 4-Mbit boot block flash memory family is also 
designed with an Automatic Power Savings (APS) 
feature to minimize system battery current drain and 
allows for very low power designs. Once the device 
is accessed to read array data, APS mode will imme- 
diately put the memory in static mode of operation 
where lIcc active current is typically 1 mA until the 
next read is initiated. 
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When the CE# and RP# pins are at Vcc and the 
BYTE# pin (28F400BxX-only) is at either Vcc or 
GND the CMOS Standby mode is enabled where 
Icc is typically 50 pA. 


A Deep Power-Down Mode is enabled when the 
RP # pin is at ground minimizing power consumption 
and providing write protection during power-up con- 
ditions. lec current during deep power-down mode 
is 0.20 yA typical. An initial maximum access time 
or Reset Time of 300 ns is required from RP# 
switching until outputs are valid. Equivalentiy, the 
device has a maximum wake-up time of 215 ns until 
writes to the Command User Interface are recog- 
nized. When RP # is at ground the WSM is reset, the 
Status Register is cleared and the entire device is 
protected from being written to. This feature pre- 
vents data corruption and protects the code stored 
in the device during system reset. The system Reset 
pin can be tied to RP# to reset the memory to nor- 
mal read mode upon activation of the Reset pin. 
With on-chip program/erase automation in the 
4-Mbit family and the RP # functionality for data pro- 
tection, when the CPU is reset and even if a program 
or erase command is issued, the device will not rec- 
ognize any operation until RP # returns to its normal 
state. 


For the 28F400BX, Byte-wide or Word-wide In- 
put/Output Control is possible by controlling the 
BYTE# pin. When the BYTE# pin is at a logic low 
the device is in the byte-wide mode (x8) and data is 
read and written through DQ[0:7]. During the byte- 
wide mode, DQ[8:14] are tri-stated and DQ15/A-1 
becomes the lowest order address pin. When the 
BYTE# pin is at a logic high the device is in the 
word-wide mode (x16) and data is read and written 
through DQ[0:15]. 


1.2 Applications 


The 4-Mbit boot block flash memory family com- 
bines high density, high performance, cost-effective 
flash memories with blocking and hardware protec- 
tion capabilities. Its flexibility and versatility will re- 
duce costs throughout the product life cycle. Flash 
memory is ideal for Just-In-Time production flow, re- 
ducing system inventory and costs, and eliminating 
component handling during the production phase. 


During the product life cycle, when code updates or 


feature enhancements become necessary, flash 
memory will reduce the update costs by allowing ei- 
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ther a user-performed code change via floppy disk 
or a remote code change via a serial link. The 4-Mbit 
boot block flash memory family provides full func- 
tion, blocked flash memories suitable for a wide 
range of applications. These applications include 
Extended PC BIOS and ROM-able applications 
storage, Digital Cellular Phone program and data 
storage, Telecommunication boot/firmware, Print- 
er firmware/font storage and various other embed- 
ded applications where both program and data stor- 
age are required. 


Reprogrammable systems such as personal com- 
puters, are ideal applications for the 4-Mbit flash 
memory products. Portable and handheld personal 
computer applications are becoming more complex 
with the addition of power management software to 
take advantage of the latest microprocessor tech- 
nology, the availability of ROM-based application 
software, pen tablet code for electronic hand writing, 
and diagnostic code. Figure 1 shows an example of 
a 28F400BX-T application. 


This increase in software sophistication augments 
the probability that a code update will be required 
after the PC is shipped. The 4-Mbit flash memory 
products provide an inexpensive update solution for 
the notebook and handheld personal computers 
while extending their product lifetime. Furthermore, 
the 4-Mbit flash memory products’ power-down 
mode provides added flexibility for these battery- 
operated portable designs which require operation 
at very low power levels. 


The 4-Mbit flash memory products also provide ex- 
cellent design solutions for Digital Cellular Phone 
and Telecommunication switching applications re- 
quiring high performance, high density storage capa- 
bility coupled with modular software designs, and a 
small form factor package (X8-only bus). The 
4-Mbit’s blocking scheme allows for an easy seg- 
mentation of the embedded code with; 16 Kbytes of 
Hardware-Protected Boot code, 4 Main Blocks of 
program code and 2 Parameter Blocks of 8 Kbytes 
each for frequently updatable data storage and diag- 
nostic messages (e.g., phone numbers, authoriza- 
tion codes). Figure 2 is an example of such an appli- 
cation with the 28FO04BxX-T. 


These are a few actual examples of the wide range 
of applications for the 4-Mbit Boot Block flash mem- 
ory family which enable system designers achieve 
the best possible product design. Only your imagina- 
tion limits the applicability of such a versatile product 
family. 
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GPIO 


82360SL RESET# 


Controller 


GPIO 
RESET# Switch 
PWRGOOD 


SD[0:14] Spader DQ9-45 
XCEIVER 
SAg-17 Ao-17 


28F400BX-T 


80386SL  .ROMCSO# CE# 
MEMRD# OE# 


290451 -4 


ADDRESS 
“16:18 LATCHES 


Ag-Ais 
ALE 
DQ)-DQ, Ap-Ajg 
80C188EB 


UCS# CE# 2gF004BX-T 
Vpp 


Px 


WR# 
RD# 
RESIN# 


SYSTEM RESET 290451-24 


Figure 2. 28F004BX Interface to INTEL 80C188EB 8-Bit Embedded Microprocessor 
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1.3 Pinouts 


The 28F400BX 44-Lead PSOP pinout follows the in- 
dustry standard ROM/EPROM pinout as shown in 
Figure 3. Furthermore, the 28F400BX 56-Lead 
TSOP pinout shown in Figure 4 provides density up- 
grades to future higher density boot block memories. 


270400 


intel. 


The 28F004BX 40-Lead TSOP pinout shown in Fig- 
ure 5 is 100% compatible and provides a density 
upgrade for the 2-Mbit Boot Block flash memory or 
the 28FO02BX. 


27C400 


PA28F400BX 
44 LEAD PSOP 


0.525” x 1.110” 
TOP VIEW 


290451-25 


Figure 3. PSOP Lead Configuration for x8/x16 28F400BX 
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54] BYTE# 


52 00,5 /A_, 


28F400BX 
56-LEAD TSOP 
14mm x 20mm 

TOP VIEW 


290451-3 


Figure 4. TSOP Lead Configuration for x8/x16 28F400BX 


28F004BX 
40-LEAD TSOP 


10mm x 20mm 
TOP VIEW 


290451-20 


Figure 5. TSOP Lead Configuration for x8 28FO004BX 
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1.4 28F400BX Pin Descriptions 


ADDRESS INPUT: When Ag is at 12V the signature mode is accessed. During this mode Ao 
decodes between the manufacturer and device ID’s. When BYTE # is at a logic low only the 
lower byte of the signatures are read. DQ;5/A_ is a don’t care in the signature mode when 
BYTE # is low. 


I/O | DATAINPUTS/OUTPUTS: Inputs array data on the second CE # and WE # cycle during a 
program command. Inputs commands to the command user interface when CE # and WE # 
are active. Data is internally latched during the write and program cycles. Outputs array, 
Intelligent Identifier and Status Register data. The data pins float to tri-state when the chip is 


DQ o-DQ7 
deselected or the outputs are disabled. 


DQs-DQ;5 | I/O | DATAINPUTS/OUTPUTS: Inputs array data on the second CE # and WE # cycle during a 
program command. Data is internally latched during the write and program cycles. Outputs 
CE# 


array data. The data pins float to tri-state when the chip is deselected or the outputs are 
disabled as in the byte-wide mode (BYTE # = ‘‘0’’). In the byte-wide mode DQ 5/A_ 4 
becomes the lowest order address for data output on DQ9-DQ7. 


CHIP ENABLE: Activates the device’s control logic, input buffers, decoders and sense 
amplifiers. CE # is active low; CE # high deselects the memory device and reduces power 

consumption to standby levels. If CE # and RP# are high, but not at a CMOS high level, the 
standby current will increase due to current flow through the CE # and RP # input stages. 


RESET/DEEP POWER-DOWN: Provides three-state control. Puts the device in deep power- 
down mode. Locks the boot block from program/erase. 

When RP # is at logic high level and equals 6.5V maximum the boot block is locked and 
cannot be programmed or erased. 

When RP# = 11.4V minimum the boot block is unlocked and can be programmed or 
erased. 

When FP # is at a logic low level the boot block is locked, the deep power-down mode is 
enabled and the WSM is reset preventing any blocks from being programmed or erased, 
therefore providing data protection during power transitions. 

When RP # transitions from logic low to logic high the flash memory enters the read-array 


OUTPUT ENABLE: Gates the device’s outputs through the data buffers during a read cycle. 
OE # is active low. 

WE # WRITE ENABLE: Controls writes to the Command Register and array blocks. WE # is active 
low. Addresses and data are latched on the rising edge of the WE # pulse. 


BYTE # ENABLE: Controls whether the device operates in the byte-wide mode (x8) or the 
word-wide mode (x16). BYTE # pin must be controlled at CMOS levels to meet 100A CMOS 
current in the standby mode. BYTE # = “0” enables the byte-wide mode, where data is read 
and programmed on DQo-DQ7 and DQ;5/A_ 4 becomes the lowest order address that 
decodes between the upper and lower byte. DQg—DQy,, are tri-stated during the byte-wide 
mode. BYTE# = ‘1” enables the word-wide mode where data is read and programmed on 


PROGRAM/ERASE POWER SUPPLY: For erasing memory array blocks or programming 
data in each block. 
Note: Vpp < Vpp_max Memory contents cannot be altered. 
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1.5 28F004BX Pin Descriptions 


Ao-Aig ADDRESS INPUTS for memory addresses. Addresses are internally latched during 
a write cycle. 
Ag ADDRESS INPUT: When Ag is at 12V the signature mode is accessed. During this 
mode Ao decodes between the manufacturer and device ID’s. 


DQo-DQ7 I/O | DATA INPUTS/OUTPUTS: Inputs array data on the second CE # and WE # cycle 
during a program command. Inputs commands to the command user interface when 
CE # and WE # are active. Data is internaily latched during the write and program 
cycles. Outputs array, Intelligent Identifier and status register data. The data pins 
float to tri-state when the chip is deselected or the outputs are disabled. 


CHIP ENABLE: Activates the device’s control logic, input buffers, decoders and 
sense amplifiers. CE # is active low; CE # high deselects the memory device and 
reduces power consumption to standby levels. If CE # and RP# are high, but not at 
a CMOS high level, the standby current will increase due to current flow through the 
CE # and RP # input stages. 


ae 

RP# RESET/DEEP POWERDOWN: Provides Three-State control. Puts the device in 
deep power-down mode. Locks the Boot Block from program/erase. 
When FP # is at logic high level and equals 6.5V maximum the Boot Block is locked 
and cannot be programmed or erased. 
When RP# = 11.4V minimum the Boot Block is unlocked and can be programmed 
or erased. 
When FP # is at a logic low level the Boot Block is locked, the deep power-down 
mode is enabled and the WSM is reset preventing any blocks from being 
programmed or erased, therefore providing data protection during power transitions. 
When RP # transitions from logic low to logic high, the flash memory enters the 
read-array mode. 

boli Bs 

il bd 

Reet 

eae ee 

reno | 

i ae ee 

i Se ae 


OUTPUT ENABLE: Gates the device’s outputs through the data buffers during a 
read cycle. OE # is active low. 

WRITE ENABLE: Controls writes to the Command Register and array blocks. WE # 
is active low. Addresses and data are latched on the rising edge of the WE # pulse. 


PROGRAM/ERASE POWER SUPPLY: For erasing memory array blocks or 


programming data in each block. 
NOTE: Vpp < Vpp_max Memory contents cannot be altered. 


DEVICE POWER SUPPLY (5V + 10%, 5V +5%) 
GROUND: For all internal circuitry. 


NO CONNECT: Pin may be driven or left floating 


DON’T USE PIN: Pin should not be connected to anything. 
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2.0 28F400BX WORD/BYTE-WIDE PRODUCTS DESCRIPTION 
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Figure 6. 28F400BX Word/Byte Block Diagram 
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2.1 28F400BX Memory Organization 


2.1.1 BLOCKING 


The 28F400BX uses a blocked array architecture to 
provide independent erasure of memory blocks. A 
block is erased independently of other blocks in the 
array when an address is given within the block ad- 
dress range and the Erase Setup and Erase Confirm 
commands are written to the CUI. The 28F400BxX is 
a random read/write memory, only erasure is per- 
formed by block. 


2.1.1.1 Boot Block Operation and Data 
Protection 


The 16-Kbyte boot block provides a lock feature for 
secure code storage. The intent of the boot block is 
to provide a secure storage area for the kernel code 
that is required to boot a system in the event of pow- 
er failure or other disruption during code update. 
This lock feature ensures absolute data integrity by 
preventing the boot block from being written or 
erased when RP # is not at 12V. The boot block can 
be erased and written when RP # is held at 12V for 
the duration of the erase or program operation. This 
allows customers to change the boot code when 
necessary while providing security when needed. 
See the Block Memory Map section for address lo- 
cations of the boot block for the 28F400BX-T and 
28F400BX-B. 


2.1.1.2 Parameter Block Operation 


The 28F400BX has 2 parameter blocks (8-Kbytes 
each). The parameter blocks are intended to provide 
storage for frequently updated system parameters 
and configuration or diagnostic information. The pa- 
rameter blocks can also be used to store additional 
boot or main code. The parameter blocks however, 
do not have the hardware write protection feature 
that the boot block has. The parameter blocks pro- 
vide for more efficient memory utilization when deal- 
ing with parameter changes versus regularly blocked 
devices. See the Block Memory Map section for ad- 
dress locations of the parameter blocks for the 
28F400BX-T and 28F400BX-B. 


2.1.1.3 Main Block Operation 


Four main blocks of memory exist on the 28F400BX 
(3 x 128-Kbyte blocks and 1 x 96-Kbyte blocks). See 
the following section on Block Memory Map for the 
address location of these blocks for the 28F400BX-T 
and 28F400BX-B products. 
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2.1.2. BLOCK MEMORY MAP 


Two versions of the 28F400BX product exist to sup- 
port two different memory maps of the array blocks 
in order to accommodate different microprocessor 
protocols for boot code location. The 28F400BX-T 
memory map is inverted from the 28F400BX-B 
memory map. 


2.1.2.1. 28F400BX-B Memory Map 


The 28F400BX-B device has the 16-Kbyte boot 
block located from OO000H to 01FFFH to accommo- 
date those microprocessors that boot from the bot- 
tom of the address map at OOOOOH. In the 
28F400BX-B the first 8-Kbyte parameter block re- 
sides in memory space from 02000H to O2FFFH. 
The second 8-Kbyte parameter block resides in 
memory space from O3000H to O3FFFH. The 
96-Kbyte main block resides in memory space from. 
04000H to OFFFFH. The three 128-Kbyte main 
block resides in memory space from 10000H to 
1FFFFH, 20000H to 2FFFFH and 30000H to 
3FFFFH (word locations). See Figure 7. 


(Word Addresses) 
3FFFFH 


128-Kbyte MAIN BLOCK . 


30000H 
2FFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128-Kbyte MAIN BLOCK 


10000H 
OFFFFH 


96-Kbyte MAIN BLOCK 


04000H 
O3FFFH 


03000H 
O2FFFH 


02000H 
01FFFH 


00000H 


Figure 7. 28F400BX-B Memory Map 
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2.1.2.2 28F400BX-T Memory Map 


The 28F400BX-T device has the 16-Kbyte boot 
block located from 3EQ00H to 3FFFFH to accom- SFFFFH 
modate those microprocessors that boot from the 
top of the address map. In the 28F400BX-T the first apenbia 
8-Kbyte parameter block resides in memory space 3DFEFFH 
from 3D000H to 3DFFFH. The second 8-Kbyte pa- | 
rameter block resides in memory space from 
3CO00H to 3CFFFH. The 96-Kbyte main block re- 
sides in memory space from 30000H to 3BFFFH. SCO00H 

The three 128-Kbyte main blocks reside in memory SEErEW 

space from 20000H to 2FFFFH, 10000H to 1FFFFH 96-Kbyte MAIN BLOCK 
and OOOO0OH to OFFFFH as shown below in Figure 8. 


(Word Addresses) 


3D000H 
3CFFFH 


30000H 
2FFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128-Kbyte MAIN BLOCK 


10000H 
OFFFFH 


128-Kbyte MAIN BLOCK 


00000H 


Figure 8. 28F400BX-T Memory Map 
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3.0 28F004BX PRODUCT DESCRIPTION 


“Vpp 
290451-19 


+ Voc 
+ GND 


INTERFACE 


1/0 LOGIC 
WRITE STATE PROGRAM/ERASE 
MACHINE VOLTAGE SWITCH 


49018 NIVA 

Y3LSI93Y JLAGA-8Z1 
Viva 

M9018 NIVN 

JLAGA-8Z1 


40018 NIVN 
JLAGA-8Z1 


a © 
i < 
Le — = 
EY 4 < 
=O Oo Qo 
ld ve) = 
A - o 

oO 


49018 NIVA 
JLAS-96 


M9018 YILINVYVd 


3LASA-8 
YIXIIILINNG 
INdino 9018 YSLINVYVd 


JLAG-8 


Y-GATING/ SENSING 


49018 1008 
JLAGA-91 


REDUCTION 
Y-DECODER 
X-DECODER 


ADDRESS 
COUNTER 


Figure 9. 28FO004BX Byte-Wide Block Diagram 
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3.1 28F004BX Memory Organization 


3.1.1 BLOCKING: 


The 28F004BX uses a blocked array architecture to 
provide independent erasure of memory blocks. A 
block is erased independently of other blocks in the 
array when an address is given within the block ad- 
dress range and the Erase Setup and Erase Confirm 
commands are written to the CUI. The 28FO004BxX is 
a random read/write memory, only erasure is per- 
formed by block. 


3.1.1.1 Boot Block Operation and Data 
Protection 


The 16-Kbyte boot block provides a lock feature for 
secure code storage. The intent of the boot block is 
to provide a secure storage area for the kernel code 
that is required to boot a system in the event of pow- 
er failure or other disruption during code update. 
This lock feature ensures absolute data integrity by 
preventing the boot block from being programmed 
or erased when RP# is not at 12V. The boot block 
can be erased and programmed when RP # is held 
at 12V for the duration of the erase or program oper- 
ation. This allows customers to change the boot 
code when necessary while still providing security 
when needed. See the Block Memory Map section 
for address locations of the boot block for the 
28F004BX-T and 28F004BX-B. 


3.1.1.2 Parameter Block Operation 


The 28F004BX has 2 parameter blocks (8-Kbytes 
each). The parameter blocks are intended to provide 
storage for frequently updated system parameters 
and configuration or diagnostic information. The pa- 
rameter blocks can also be used to store additional 
boot or main code. The parameter blocks however, 
do not have the hardware write protection feature 
that the boot block has. Parameter blocks provide 
for more efficient memory utilization when dealing 
with small parameter changes versus regularly 
blocked devices. See the Block Memory Map sec- 
tion for address locations of the parameter blocks 
for the 28F004BX-T and 28F004BX-B. 


3.1.1.3 Main Block Operation 


Four main blocks of memory exist on the 28FO04BX 
(3 x 128-Kbyte blocks and 1 x 96-Kbyte blocks). 
See the following section on Block Memory Map for 
the address location of these blocks for the 
28F004BX-T and 28F004BX-B. 
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3.1.2 BLOCK MEMORY MAP 


Two versions of the 28F004BX product exist to sup- 
port two different memory maps of the array blocks 
in order to accommodate different microprocessor 
protocols for boot code location. The 28F004BX-T 
memory map is inverted from the 28F004BX-B 
memory map. 


3.1.2.1 28F004BX-B Memory Map 


The 28F004BX-B device has the 16-Kbyte boot 
block located from O0000H to O3FFFH to accommo- 
date those microprocessors that boot from the bot- 
tom of the address map at QOOOOOH. In the 
28F004BX-B the first 8-Kbyte parameter block re- 
sides in memory from 04000H to O5FFFH. The sec- 
ond 8-Kbyte parameter block resides in memory 
space from O06000H to O7FFFH. The 96-Kbyte main 
block resides in memory space from O08000H to 
1FFFFH. The three 128-Kbyte main block reside in 
memory space from 20000H to 3FFFFH, 40000H to 
5FFFFH and 60000H to 7FFFFH. See Figure 10. 


7FFFFH 


128-Kbyte MAIN BLOCK 


60000H 
5FFFFH 


128-Kbyte MAIN BLOCK 


40000H 
SFFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


96-Kbyte MAIN BLOCK 


08000H 
O7FFFH 


06000H 
O5FFFH 


04000H 
O3FFFH 


8-Kbyte PARAMETER BLOCK 


8-Kbyte PARAMETER BLOCK 


16-Kbyte BOOT BLOCK 
00000H 


Figure 10. 28FO004BX-B Memory Map 
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3.1.2.2 28F004BX-T Memory Map 


The 28F004BX-T device has the 16-Kbyte boot 
block located from 7COOOH to 7FFFFH to accom- 
modate those microprocessors that boot from the 
top of the address map. In the 28F004BX-T the first 
8-Kbyte parameter block resides in memory space 
from 7AOOOH to 7BFFFH. The second 8-Kbyte pa- 
rameter block resides in memory space from 
78000H to 79FFFH. The 96-Kbyte main block re- 
sides in memory space from 60000H to 77FFFH. 
The three 128-Kbyte main blocks reside in memory 
space from 40000H to 5FFFFH, 20000H to 3FFFFH 
and O0000H to 1FFFFH. 


16-Kbyte BOOT BLOCK 


8-Kbyte PARAMETER BLOCK 


7FFFFH 


7CO00H 
7BFFFH 


7A000H 
79FFFH 


78000H 
77FFFH 


8-Kbyte PARAMETER BLOCK 


96-Kbyte MAIN BLOCK 


60000H 
5FFFFH 


128-Kbyte MAIN BLOCK 


40000H 
3FFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128-Kbyte MAIN BLOCK 


00000H 


Figure 11. 28FO004BX-T Memory Map 
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4.0 PRODUCT FAMILY PRINCIPLES 
OF OPERATION 


Flash memory augments EPROM functionality with 
in-circuit electrical write and erase. The 4-Mbit flash 
family utilizes a Command User Interface (CUI) and 
internally generated and timed algorithms to simplify 
write and erase operations. 


The CUI allows for 100% TTL-level control inputs, 
fixed power supplies during erasure and program- 
ming, and maximum EPROM compatibility. 


In the absence of high voltage on the Vpp pin, the 
4-Mbit boot block flash family will only successfully 
execute the following commands: Read Array, Read 
Status Register, Clear Status Register and Intelli- 
gent Identifier mode. The device provides standard 
EPROM read, standby and output disable opera- 
tions. Manufacturer Identification and Device Identi- 
fication data can be accessed through the CUI or 
through the standard EPROM Ag high voltage _ac- 
cess (Vip) for PROM programming equipment. 


The same EPROM read, standby and output disable 
functions are available when high voltage is applied 
to the Vpp pin. In addition, high voltage on Vpp al- 
lows write and erase of the device. All functions as- 
sociated with altering memory contents: write and 
erase, Intelligent Identifier read and Read Status are 
accessed via the CUI. 


The purpose of the Write State Machine (WSM) is to 
completely automate the write and erasure of the 
device. The WSM will begin operation upon receipt 
of a signal from the CUI and will report status back 
through a Status Register. The CUI will handle the 
WE # interface to the data and address latches, as 
well as system software requests for status while the 
WSM is in operation. 


4.1 28F400BX Bus Operations 


Flash memory reads, erases and writes in-system 
via the local CPU. All bus cycles to or from the flash 
memory conform to standard microprocessor bus 
cycles. 


| 
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Table 1. Bus Operations for WORD-WIDE Mode (BYTE # = Vip) 


Deep Power-Down 


Intelligent 
Identifier (Mfr) 


Intelligent ViL VIL Vin | Vip 
Identifier (Device) 


6.7.8 Vi Vit 


NOTES: 

Refer to DC Characteristics. 3 

X can be V_, Vip for control pins and addresses, Vpp, or Vppy for Vpp. 

. See DC Characteristics for Vpp_, VppH, VuH, Vip voltages. 

. Manufacturer and Device codes may also be accessed via a CUI write sequence. Ay-Ay7 = X. 
. Device ID = 4470H for 28F400BX-T and 4471H for 28F400BX-B. 

. Refer to Table 4 for valid Dixy during a write operation. 

Command writes for Block Erase or Word/Byte Write are only executed when Vpp = Vppy. 

. To write or erase the boot block, hold RP# at Vyp. 

. RP# must be at GND +0.2V to meet the 1.2 wA maximum deep power-down current. 


OMNOANARWND— 
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4.2 28F004BX Bus Operations 
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Table 3. Bus Operations 


Intelligent Identifier (Mfr) 


Intelligent Identifier (Device) 


. Refer to DC Characteristics. 


Refer to Table 4 for valid Djjy during a write operation. 


OMNMAHAWDS 


4.3 Read Operations 


The 4-Mbit boot block flash family has three user 
read modes; Array, Intelligent Identifier, and Status 
Register. Status Register read mode will be dis- 
cussed in detail in the “Write Operations” section. 


During power-up conditions (Vcc supply ramping), it 
takes a maximum of 600 ns from when Vcc is at 
4.5V minimum to valid data on the outputs. 


4.3.1 READ ARRAY 


If the memory is not in the Read Array mode, it is 
necessary to write the appropriate read mode com- 
mand to the CUI. The 4-Mbit boot block flash family 
has three control functions, all of which must be 
logically active, to obtain data at the outputs. 
Chip-Enable CE# is the device selection control. 
Power-Down RP # is the device power control. Out- 
put-Enable OE# is the DATA INPUT/OUTPUT 
(DQ[0:15] or DQ[0:7]) direction control and when 
active is used to drive data from the selected memo- 
ry on to the I/O bus. 


4.3.1.1 Output Control 


With OE# at logic-high level (Vj), the output from 
the device is disabled and data input/output pins 
(DQ[0:15] or DQ[0:7] are tri-stated. Data input is 
then controlled by WE #. 
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. X can be Vi_ or Viy for control pins and addresses, Vpp, or Vppy for Vpp. 

See DC Characteristics for Vpp_, VppH, VHH, Vip voltages. 

Manufacturer and Device codes may also be accessed via a CUI write sequence. A;—Ajg = X. 
Device ID = 78H for 28F004BX-T and 79H for 28F004BX-B. 


. Command writes for Block erase or byte program are only executed when Vpp = Vppy. 
. Program or erase the Boot block by holding RP # at Vyp. 
. RP# must be at GND +0.2V to meet the 1.2 »A maximum deep power-down current. 


4.3.1.2 Input Control 


With WE # at logic-high level (Vj), input to the de- 
vice is disabled. Data Input/Output pins (DQ[0:15] 
or DQ[0:7]) are controlled by OE#. 


4.3.2 INTELLIGENT IDENTIFIERS 


28F400BX PRODUCTS | 


The manufacturer and device codes are read via the 
CUI or by taking the Ag pin to 12V. Writing 90H to 
the CUI places the device into Intelligent Identifier 
read mode. A read of location OOOOOH outputs the 
manufacturer’s identification code, 0089H, and loca- 
tion 00001H outputs the device code; 4470H for 
28F400BX-T, 4471H for 28F400BX-B. When 
BYTE# is at a logic low only the lower byte of the 
above signatures is read and DQ;5/A~_, is a “don’t 
care” during Intelligent Identifier mode. A read array 
command must be written to the memory to return to 
the read array mode. 


28F004BX PRODUCTS 


The manufacturer and device codes are also read 
via the CUI or by taking the Ag pin to 12V. Writing 
90H to the CUI places the device into Intelligent 
Identifier read mode. A read of location OOOOOH out- 
puts the manufacturer’s identification code, 89H, 
and location 00001H outputs the device code; 78H 
for 28FO04BX-T, 79H for 28F004BX-B. 
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4.4 Write Operations 


Commands are written to the CUI using standard mi- 
croprocessor write timings. The CUI serves as the 
interface between the microprocessor and the inter- 
nal chip operation. The CUI can decipher Read Ar- 
ray, Read Intelligent Identifier, Read Status Register, 
Clear Status Register, Erase and Program com- 
mands. In the event of a read command, the CUI 
simply points the read path at either the array, the 
Intelligent Identifier, or the status register depending 
on the specific read command given. For a program 
or erase cycle, the CUI informs the write state ma- 
chine that a write or erase has been requested. Dur- 
ing a program cycle, the Write State Machine will 
control the program sequences and the CUI will only 
respond to status reads. During an erase cycle, the 
CUI will respond to status reads and erase suspend. 
After the Write State Machine has completed its 
task, it will allow the CUI to respond to its full com- 
mand set. The CUI will stay in the current command 
state until the microprocessor issues another com- 
mand. 


The CUI will successfully initiate an erase or write 
operation only when Vpp is within its voltage range. 
Depending upon the application, the system design- 
er may choose to make the Vpp power supply 
switchable, available only when memory updates 
are desired. The system designer can also choose 
to ‘“hard-wire” Vpp to 12V. The 4-Mbit boot block 
flash family is designed to accommodate—either de- 
sign practice. It is recommended that RP # be tied to 
logical Reset for data protection during unstable 
CPU reset function as described in the ‘Product 
Family Overview” section. 


4.4.1 BOOT BLOCK WRITE OPERATIONS 
In the case of Boot Block modifications (write and 


erase), RP# is set to Vu = 12V typically, in addi- 
tion to Vpp at high voltage. 


7 2 . 
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However, if RP# is not at Vy when a program or 
erase operation of the boot block is attempted, the 
corresponding status register bit (Bit 4 for Program 
and Bit 5 for Erase, refer to Table 5 for Status Regis- 


ter Definitions) is set to indicate the failure to com- 
plete the operation. 


4.4.2 COMMAND USER INTERFACE (CUI) 


The Command User Interface (CUI) serves as the. 
interface to the microprocessor. The CUI points the 
read/write path to the appropriate circuit block as 
described in the previous section. After the WSM 
has completed its task, it will set the WSM Status bit 
to a “1”, which will also allow the CUI to respond to 
its full command set. Note that after the WSM has 
returned control to the CUI, the CUI will remain in its 
current state. 


4.4.2.1 Command Set 


Command Device Mode 
Codes 


Invalid/ Reserved 

Alternate Program Setup 
Erase Setup 

Program Setup 

Clear Status Register 

Read Status Register 
Intelligent Identifier 

Erase Suspend 

Erase Resume/Erase Confirm 
‘Read Array : 


4.4.2.2 Command Function Descriptions 


Device operations are selected by writing specific 
commands into the CUI. Table 4 defines the 4-Mbit 
boot block flash family commands. 
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Table 4. Command Definitions 


First Bus Cycle Second Bus Cycle 


a6 Si A Be 
24 | wite |x [eon] reed | 1A | 10 
Twite | x [70H] ead | x [SRO 
wits [xo 
-[wite |x [eon | wite | x [oon 


Read Array 
Intelligent Identifier 
Read Status — 


Alternate Word/Byte 
Write Setup/Write 


NOTES: 
1. Bus operations are defined in Tables 1, 2, 3. 


2. |A = Identifier Address: OOH for manufacturer code, 01H for device code. 


3. SRD = Data read from Status Register. 
4. ID = Intelligent Identifier Data. 


Following the Intelligent Identifier Command, two read operations access manufacturer and device codes. 


5. BA = Address within the block being erased. 
6. WA = Address to be written. 

WD = Data to be written at location WD. 

7. Either 40H or 10H commands is valid. 


8. When writing commands to the device, the upper data bus [DQg—DQ 5] = X (28F400BX-only) which is either Voc or Vss 


to avoid burning additional current. 


invalid/Reserved 


These are unassigned commands. It is not recom- 
mended that the customer use any command other 
than the valid commands specified above. Intel re- 
serves the right to redefine these codes for future 
functions. 


Read Array (FFH) 


This single write command points the read path at 
the array. If the host CPU performs a CE#/OE# 
controlled read immediately following a two-write se- 
quence that started the WSM, then the device will 
output status register contents. If the Read Array 
command is given after Erase Setup the device is 
reset to read the array. A two Read Array command 
sequence (FFH) is required to reset to Read Array 
after Program Setup. 


intelligent Identifier (90H) 


After this command is executed, the CUI points the 
output path to the Intelligent Identifier circuits. Only 
Intelligent Identifier values at addresses 0 and 1 can 
be read (only address Apo is used in this mode, all 
other address inputs are ignored). 


ADVANCE INFORMATION 


Read Status Register (70H) 


This is one of the two commands that is executable 
while the state machine is operating. After this com- 
mand is written, a read of the device will output the 
contents of the status register, regardless of the ad- 
dress presented to the device. 


The device automatically enters this mode after pro- 
gram or erase has completed. 


Clear Status Register (50H) 


The WSM can only set the Program Status and 
Erase Status bits in the status register, it can not 
clear them. Two reasons exist for operating the 
status register in this fashion. The first is a synchro- 
nization. The WSM does not know when the host 
CPU has read the status register, therefore it would 
not know when to clear the status bits. Secondly, if 
the CPU is programming a string of bytes, it may be 
more efficient to query the status register after pro- 
gramming the string. Thus, if any errors exist while 
programming the string, the status register will return 
the accumulated error status. 
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Program Setup (40H or 10H) 


This command simply sets the CUI into a state such 
that the next write will load the address and data 
registers. Either 40H or 10H can be used for Pro- 
gram Setup. Both commands are included to ac- 
commodate efforts to achieve an industry standard 
command code set. 


Program 


The second write after the program setup command, 
will latch addresses and data. Also, the CUI initiates 
the WSM to begin execution of the program algo- 
rithm. While the WSM finishes the algorithm, the de- 
vice will output Status Register contents. Note that 
the WSM cannot be suspended during program- 
ming. 


Erase Setup (20H) 


Prepares the CUl for the Erase Confirm command. 
No other action is taken. If the next command is not 
an Erase Confirm command then the CUI will set 
both the Program Status and Erase Status bits of the 
Status Register to a “1”, place the device into the 
Read Status Register state, and wait for another 
command. 


Erase Confirm (DOH) 


If the previous command was an Erase Setup com- 
mand, then the CUI will enable the WSM to erase, at 
the same time closing the address and data latches, 
and respond only to the Read Status Register and 
Erase Suspend commands. While the WSM is exe- 
cuting, the device will output Status Register data 
when OE # is toggled low. Status Register data can 
only be updated by toggling either OE # or CE # low. 


Erase Suspend (BOH) 


This command only has meaning while the WSM is 
executing an Erase operation, and therefore will only 
be responded to during an erase operation. After 
this command has been executed, the CUI will set 
an output that directs the WSM to suspend Erase 
operations, and then return to responding to only 
Read Status Register or to the Erase Resume com- 
mands. Once the WSM has reached the Suspend 
state, it will set an output into the CU! which allows 
the CUI to respond to the Read Array, Read Status 
Register, and Erase Resume commands. In this 
mode, the CUI will not respond to any other com- 
mands. The WSM will also set the WSM Status bit to 
a “1”. The WSM will continue to run, idling in the 
SUSPEND state, regardless of the state of all input 
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control pins, with the exclusion of RP#. RP# will 
immediately shut down the WSM and the remainder 
of the chip. During a suspend operation, the data 
and address latches will remain closed, but the ad- 


dress pads are able to drive the address into the 
read path. 


Erase Resume (DOH) 


This command will cause the CUI to clear the Sus- 
pend state and set the WSM Status bit to a “0”, but 
only if an Erase Suspend command was previously 
issued. Erase Resume will not have any effect in all 
other conditions. 


4.4.3 STATUS REGISTER 


The 4-Mbit boot block flash family contains a status 
register which may be read to determine when a pro- 
gram or erase operation is complete, and whether 
that operation completed successfully. The status 
register may be read at any time by writing the Read 
Status command to the CUI. After writing this com- 
mand, all subsequent Read operations output data 
from the status register until another command is 
written to the CUI. A Read Array command must be 
written to the CUI to return to the Read Array mode. 


The status register bits are output on DQ[0:7] 
whether the device is in the byte-wide (x8) or word- 
wide (x16) mode for the 28F400BxX. In the word-wide 
mode the upper byte, DQ[8:15] is set to OOH during 
a Read Status command. In the byte-wide mode, 
DQ[8:14] are tri-stated and DQ;5/A_, retains the 
low order address function. 


It should be noted that the contents of the status 
register are latched on the falling edge of OE# or 
CE# whichever occurs last in the read cycle. This: 
prevents possible bus errors which might occur if the 
contents of the status register change while reading 
the status register. CE# or OE# must be toggled 
with each subsequent status read, or the completion 
of a program or erase operation will not be evident. 


The Status Register is the interface between the mi- 


- croprocessor and the Write State Machine (WSM). 


When the WSM is active, this register will indicate 
the status of the WSM, and will also hold the bits 
indicating whether or not the WSM was successful in 
performing the desired operation. The WSM sets 
status bits “Three” through “Seven” and clears bits 
“Six” and “Seven”, but cannot clear status bits 
“Three” through “Five”. These bits can only be 
cleared by the controlling CPU through the use of 
the Clear Status Register command. 
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Table 5. Status Register Definitions 


wsws| ess | es | ps | vers} RA | R | A 
£ 6 5 & 3 2 1 0 


WRITE STATE MACHINE STATUS 
Ready 
Busy 


ERASE SUSPEND STATUS 
Erase Suspended 
Erase in Progress/Completed 


ERASE STATUS 
Error in Block Erasure 
Successful Block Erase 


PROGRAM STATUS 
Error In Byte/Word Program 
Successful Byte/Word Program 


Vpp STATUS 
Vpp Low Detect; Operation Abort 
Vpp OK 


SR.2-SR.0 = RESERVED FOR 
FUTURE ENHANCEMENTS 


4.4.3.2 Clearing the Status Register 


Certain bits in the status register are set by the write 
state machine, and can only be reset by the system 
software. These bits can indicate various failure con- 
ditions. By allowing the system software to control 
the resetting of these bits, several operations may 
be performed (such as cumulatively programming 
several bytes or erasing multiple blocks in se- 
quence). The status register may then be read to 
determine if an error occurred during that program- 
ming or erasure series. This adds flexibility to the 
way the device may be programmed or erased. To 
clear the status register, the Clear Status Register 
command is written to the CUl. Then, any other 
command may be issued to the CUI. Note again that 
before a read cycle can be initiated, a Read Array 
command must be written to the CUl to specify 
whether the read data is to come from the array, 
status register, or Intelligent Identifier. 
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NOTES: 


Write State Machine Status bit must first be checked to 
determine byte/word program or block erase comple- 
tion, before the Program or Erase Status bits are 
checked for success. 


When Erase Suspend is issued, WSM halts execution 
and sets both WSMS and ESS bits to “1”. ESS bit re- 
mains set to ‘1” until an Erase Resume command is 
issued. 


When this bit is set to “1”. WSM has applied the maxi- 
mum number of erase pulses to the block and is still 
unable to successfully perform an erase verify. 


When this bit is set to “1”, WSM has attempted but 
failed to Program a byte or word. 


The Vpp Status bit unlike an A/D converter, does not 
provide continuous indication of Vpp level. The WSM 
interrogates the Vpp level only after the byte write or 
block erase command sequences have been entered 
and informs the system if Vpp has not been switched 
on. The Vpp Status bit is not guaranteed to report ac- 
curate feedback between Vpp, and Vppy. 


These bits are reserved for future use and should be 


~ masked out when polling the Status Register. 


4.4.4 PROGRAM MODE 


Program is executed by a two-write sequence. The 
Program Setup command is written to the CUI fol- 
lowed by a second write which specifies the address 
and data to be programmed. The write state ma- 
‘chine will execute a sequence of internally timed 
events to: 


1. Program the desired bits of the addressed mem- 
ory word (byte), and 


2. Verify that the desired bits are sufficiently pro- 
grammed. 


Programming of the memory results in specific bits 
within a byte or word being changed to a “0”. 


If the user attempts to program ‘‘1’’s, there will be no 


change of the memory cell content and no error oc- 
curs. 
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Similar to erasure, the status register indicates 
whether programming is complete. While the pro- 
gram sequence is executing, bit 7 of the status regis- 
ter is a “O”. The status register can be polled by 
toggling either CE# or OE# to determine when the 
program sequence is complete. Only the Read 
Status Register command is valid while program- 
ming is active. 


When programming is complete, the status bits, 
which indicate whether the program operation was 
successful, should be checked. If the programming 
operation was unsuccessful, Bit 4 of the status regis- 
ter is set to a “1” to indicate a Program Failure. If 
Bit 3 is set then Vpp was not within acceptable limits, 
and the WSM will not execute the programming se- 
quence. 


The status register should be cleared before at- 
tempting the next operation. Any CUI instruction can 
follow after programming is completed; however, it 
must be recognized that reads from the memory, 
status register, or Intelligent Identifier cannot be ac- 
complished until the CUI is given the appropriate 
command. A Read Array command must first be giv- 
en before memory contents can be read. 


Figure 12 shows a system software flowchart for de- 
vice byte programming operation. Figure 13 shows a 
similar flowchart for device word programming oper- 
ation (28F400BxX-only). 


4.4.5 ERASE MODE 


Erasure of a single block is initiated by writing the 
Erase Setup and Erase Confirm commands to the 
CUI, along with the addresses, A[12:17] for the 
28F400BX or A[12:18] for the 28FO04BX, identifying 
the block to be erased. These addresses are latched 
internally when the Erase Confirm command is is- 
sued. Block erasure results in all bits within the block 
being set to “1”. 


The WSM will execute a sequence of internally 
timed events to: 


1. Program all bits within the block 


2. Verify that all bits within the block are sufficiently 
programmed 


3. Erase all bits within the block and 


4. Verify that all bits within the block are sufficiently 
erased 
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While the erase sequence is executing, Bit 7 of the 
status register is a “O”’. 


When the status register indicates that erasure is 
complete, the status bits, which indicate whether the 
erase operation was successful, should be checked. 
If the erasure operation was unsuccessful, Bit 5 of 
the status register is set to a “1” to indicate an 
Erase Failure. If Vpp was not within acceptable limits 
after the Erase Confirm command is issued, the 
WSM will not execute an erase sequence; instead, 
Bits of the status register is set to a “1” to indicate 
an Erase Failure, and Bit 3 is set to a “1” to identify 
that Vpp supply voltage was not within acceptable 
limits. 


The status register should be cleared before at- 
tempting the next operation. Any CUI instruction can 
follow after erasure is completed; however, it must 
be recognized that reads from the memory array, 
status register, or Intelligent Identifier can not be ac- 
complished until the CUI is given the appropriate 
command. A Read Array command must first be giv- 
en before memory contents can be read. 


Figure 14 shows a system software flowchart for 


_ Block Erase operation. 


4.4.5.1 Suspending and Resuming Erase 


Since an erase operation typically requires 1 to 3 
seconds to complete, an Erase Suspend command 
is provided. This allows erase-sequence interruption 
in order to read data from another block of the mem- 
ory. Once the erase sequence is started, writing the 
Erase Suspend command to the CUI requests that 
the Write State Machine (WSM) pause the erase se- 
quence at a predetermined point in the erase algo- 
rithm. The status register must be read to determine 
when the erase operation has been suspended. 


At this point, a Read Array command can be written 
to the CUI in order to read data from blocks other 
than that which is being suspended. The only other 
valid command at this time is the Erase Resume 
command or Read Status Register operation. 


Figure 15 shows a system software flowchart detail- 
ing the operation. 
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During Erase Suspend mode, the chip can go into a 
pseudo-standby mode by taking CE # to Vj and the 
active current is now a maximum of 10 mA. If the 
chip is enabled while in this mode by taking CE# to 
Vit, the Erase Resume command can be issued to 
resume the erase operation. 


Upon completion of reads from any block other than 
the block being erased, the Erase Resume com- 
mand must be issued. When the Erase Resume 
command is given, the WSM will continue with the 
erase sequence and complete erasing the block. As 
with the end of erase, the status register must be 
read, cleared, and the next instruction issued in or- 
der to continue. 
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4.4.6 EXTENDED CYCLING 


Intel has designed extended cycling capability into 
its ETOX Ill flash memory technology. The 4-Mbit 
boot block flash family is designed for 100,000 pro- 
gram/erase cycles on each of the seven blocks. The 
combination of low electric fields, clean oxide pro- 
cessing and minimized oxide area per memory cell 
subjected to the tunneling electric field, results in 
very high cycling capability. 
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Operation 


Write 40H, Setup Data = 40H 
Byte Address Program Address = Byte to be 
programmed 


Write Byte Program Data to be programmed 
Address/Data Address = Byte to be 
programmed 


Read Status Status Register Data. 
Register Toggle OE # or CE # to update 
Status Register 


Standby Check SR.7 
1 = Ready, 0 = Busy 


YES 
Repeat for subsequent bytes. 


Full Status Full status check can be done after each byte or after a 
Check If Desired sequence of bytes. 


Byte Program Write FFH after the last byte programming operation to 
Completed reset the device to Read Array Mode. 


290451-6 


Full Status Check Procedure 


Status Register Data 
Read (See Above) ; 
aus Command Comments . 
Operation 


Error 1 = Vpp Low Detect 
Byte Program Check SR.4 
Error 1 = Byte Program Error 


SR.3 MUST be cleared, if set during a program attempt, 


YES 
Byte Program before further attempts are allowed by the Write State 
Successful Machine. 


290451-7 SR.4 is only cleared by the Clear Status Register 
Command, in cases where multiple bytes are programmed 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 12. Automated Byte Programming Flowchart 
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Write 40H, 
Word Address 


Write Word 
Address/Data 


Register 


Read Status 


YES 


Full Status 
Check If Desired 
Word Program 
Completed 


Full Status Check Procedure 


Status Register Data 
Read (See Above) 


YES 
Word Program 
Successful 
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Vpp Range 
Error 
Word Program 
Error 
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— Command Comments 
Operation 


Setup Data = 40H 
Program Address = Word to be 
programmed 


Program Data to be programmed 
Address = Word to be 
programmed 


Status Register Data. 


Toggle OE # or CE# to update 
Status Register 


Standby Check SR.7 
1 = Ready, 0 = Busy 
Repeat for subsequent words. 


Full status check can be done after each word or after a 
sequence of words. 


Write FFH after the last word programming operation to 
reset the device to Read Array Mode. 


win Command Comments 
Operation 


Standby Check SR.3 
1 = Vpp Low Detect 


Standby Check SR.4 
1 = Word Program Error 


SR.3 MUST be cleared, if set during a program attempt, 
before further attempts are allowed by the Write State 
Machine. 


SR.4 is only cleared by the Clear Status Register 
Command, in cases where multiple words are programmed 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 13. Automated Word Programming Flowchart 
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Suspend Erase 
Loop 


Block Erase 
Completed 
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Full Status Check Procedure 


Vpp Range 
Error 
Command Sequence 
Error 
Block Erase 
Error 


YES 
Block Erase 
Successful 
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cone Command Comments 
Operation 


Data = 20H 
Address = Within block to be 
erased 


Data = DOH 
Address = Within block to be 
erased 


Status Register Data. 
Toggle OE # or CE # to update 
Status Register 


Check SR.7 
1 = Ready, 0 = Busy 


Standby 


Repeat for subsequent blocks. 


Full status check can be done after each block or after a 
sequence of blocks. 


Write FFH after the last block erase operation to reset the 
device to Read Array Mode. 


iene Command Comments 
Operation 


Check SR.3 
1 = Vpp Low Detect 


Check SR.4,5 


Both 1 = Command Sequence 
Error 


Standby 


Check SR.5 
1 = Block Erase Error 


Standby 


SR.3 MUST be cleared, if set during an erase attempt, 
before further attempts are allowed by the Write State 
Machine. 


SR.5 is only cleared by the Clear Status Register 
Command, in cases where multiple blocks are erased 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 14. Automated Biock Erase Flowchart 
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Write BOH 


Read Status 
Register 


Erase Has 
Completed 


Write FFH 


Done 
Reading? 


YES 


Write DOH 


Continue Erase 
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aus Command Comments 
Operation 


Erase Data = BOH 
Suspend 


Status Register Data. 
Toggle OE # or CE# to 
update Status Register 


Check SR.7 
= Ready 


Check SR.6 
= Suspended 


Read Array Data = FFH 


Read array data from block 
other than that being 
erased. 


Erase Resume | Data = DOH 


Figure 15. Erase Suspend/Resume Flowchart 


4.5 Power Consumption 
4.5.1 ACTIVE POWER 


With CE# at a logic-low level and RP# at a logic- 
high level, the device is placed in the active mode. 
The device Icc current is a maximum 60 mA at 
10 MHz with TTL input signals. / 


4.5.2 AUTOMATIC POWER SAVINGS 


Automatic Power Savings (APS) is a low pwer fea- 
ture during active mode of operation. The 4-Mbit 
family of products incorporate Power Reduction 
Control (PRC) circuitry which basically allows the de- 
vice to put itself into a low current state when it is 
not being accessed. After data is read from the 
memory array, PRC logic controls the device’s pow- 
er consumption by entering the APS mode where 
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maximum Icc current is 3 mA and typical Icc current 
is 1 mA. The device stays in this static state with 
outputs valid until a new location is read. 


4.5.3 STANDBY POWER 


With CE# at a logic-high level (Vj), and the CUI in 
read mode, the memory is placed in standby mode 
where the maximum Icc standby current is 100 pA 
with CMOS input signals. The standby operation dis- 
ables much of the device’s circuitry and substantially 
reduces device power consumption. The outputs 
(DQ([0:15] or DQ[0:7]) are placed in a high-imped- 
ance state independent of the status of the OE # 
signal. When the 4-Mbit boot block flash family is 
deselected during erase or program functions, the 
devices will continue to perform the erase or pro- 
gram function and consume program or erase active 
power until program or erase is completed. 
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4.5.4 RESET/DEEP POWERDOWN 


The 4-Mbit boot block flash family supports a typical 
loc of 0.2 wA in deep power-down mode. One of the 
target markets for these devices is in portable equip- 
ment where the power consumption of the machine 
is of prime importance. The 4-Mbit boot block flash 
family has a RP# pin which places the device in the 
deep powerdown mode. When RP # is at a logic-low 
(GND +0.2V), all circuits are turned off and the de- 
vice typically draws 0.2 wA of Voc current. 


During read modes, the RP# pin going low dese- 
lects the memory and places the output drivers in a 
high impedance state. Recovery from the deep pow- 
er-down state, requires a minimum of 400 ns to ac- 
cess valid data (tpyay). 


During erase or program modes, RP # low will abort 
either erase or program operation. The contents of 
the memory are no longer valid as the data has been 
corrupted by the RP# function. As in the read mode 
above, all internal circuitry is turned off to achieve 
the 0.2 wA current level. 


RP# transitions to Vj, or turning power off to the 
device will clear the status register. . 


This use of RP# during system reset is important 
with automated write/erase devices. When the sys- 
tem comes out of reset it expects to read from the 
flash memory. Automated flash memories provide 
status information when accessed during write/ 
erase modes. If a CPU reset occurs with no flash 
memory reset, proper CPU initialization would not 
occur because the flash memory would be providing 
the status information instead of array data. Intel’s 
Flash Memories allow proper CPU initialization fol- 
lowing a system reset through the use of the RP# 
input. In this application RP# is controlled by the 
same RESET # signal that resets the system CPU. 


4.6 Power-up Operation 


The 4-Mbit boot block flash family is designed to 
offer protection against accidental block erasure or 
programming during power transitions. Upon power- 
up the 4-Mbit boot block flash family is indifferent as 
to which power supply, VPP or Vcc, powers-up first. 
Power supply sequencing is not required. — 


The 4-Mbit boot block flash family ensures the CUI is 
reset to the read mode on power-up. 


In addition, on power-up the user must either drop 
CE # low or present a new address to ensure valid 
data at the outputs. 


A system designer must guard against spurious 
writes for Vcc voltages above Vixo when Vpp is 
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active. Since both WE# and CE# must be low for a 
command write, driving either signal to Vj will inhibit 
writes to the device. The CUI architecture provides 
an added level of protection since alteration of mem- 
ory contents can only occur after successful com- 
pletion of the two-step command sequences. Finally 
the device is disabled until RP # is brought to Vip, 
regardless of the state of its control inputs. This fea- 
ture provides yet another level of memory protec- 
tion. 


4.7 Power Supply Decoupling 


Flash memory’s power switching characteristics re- 
quire careful device decoupling methods. System 
designers are interested in 3 supply current issues: 


e Standby current levels (Iccs) 
e Active current levels (Iccr) 


e Transient peaks produced by falling and rising 
edges of CE#. 


Transient current magnitudes depend on the device 
outputs’ capacitive and inductive loading. Two-line 
control and proper decoupling capacitor selection 
will suppress these transient voltage peaks. Each 
flash device should have a 0.1 F ceramic capacitor 
connected between each Vcc and GND, and be- 
tween its Vpp and GND. These high frequency, low- 
inherent inductance capacitors should be placed as 
close as possible to the package leads. 


4.7.1 Vpp TRACE ON PRINTED CIRCUIT 
BOARDS 


Writing to flash memories while they reside in the 
target system, requires special consideration of the 
Vpp power supply trace by the printed circuit board 
designer. The Vpp pin supplies the flash memory 
cells current for programming and erasing. One 
should use similar trace widths and layout consider- 
ations given to the Vcc power supply trace. Ade- 
quate Vpp supply traces and decoupling will de- 
crease spikes and overshoots. 


4.7.2 Vcc, Vpp AND RP# TRANSITIONS 


The CUI latches commands as issued by system 
software and is not altered by Vpp or CE# tran- 
sitions or WSM actions. Its state upon power-up, af- 
ter exit from deep power-down mode or after Voc 
transitions below Vi xo (Lockout voltage), is Read 
Array mode. 


After any word/byte write or block erase operation is 
complete and even after Vpp transitions down to 
Vpp_, the CUI must be reset to Read Array mode via | 
the Read Array command when accesses to the - 
flash memory are desired. 
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ABSOLUTE MAXIMUM RATINGS* NOTICE: This data sheet contains information on 
products in the sampling and initial production phases 

Commercial Operating Temperature of development. The specifications are subject to 
RMT PAGS a oud ot cred 20 88 ues 0k 0°C to 70°C(1) change without notice. Verify with your local Intel 
During Block Erase Sales office that you have the latest data sheet be- 
and Word/Byte Write............... 0°C to 70°C fore finalizing a design. 
Temperature Under Bias....... — 10°C to + 80°C = * WARNING: Stressing the device beyond the “Absolute 

Extended Operating Temperature Maximum Ratings’ may cause permanent damage. 
Dung AOGO sxc vs vier iss —40°C to +85°C These are stress ratings only. Operation beyond the 
During Block Erase | “Operating Conditions” is not recommended and ex- 
and Word/Byte Write ......... —40°C to +85°C — tended exposure beyond the “Operating Conditions” 
Temperature Under Bias....... —40°C to +85°C ay affect device reliability. 

Storage Temperature .......... =~65°C to = 126°C 


Voltage on Any Pin 
(except Vcc, Vpp, Ag and RP #) 


with Respect toGND........ —2.0V to +7.0V(2) 
Voltage on Pin RP# or Pin Ag 
with Respect to GND ..... —2.0V to + 13.5V(2; 3) 


Vpp Program Voltage with Respect 
to GND during Block Erase 


and Word/Byte Write ..... —2.0V to + 14.0V(2, 3) 
Vcc Supply Voltage 

with Respect toGND........ —2.0V to +7.0V(2) 
Output Short Circuit Current............. 100 mA(4) 
NOTES: 


1. Operating temperature is for commercial product defined by this specification. 

2. Minimum DC voltage is —0.5V on input/output pins. During transitions, this level may undershoot to —2.0V for periods 
<20 ns. 

Maximum DC voltage on input/output pins is Voc + 0.5V which, during transitions, may overshoot to Vcc + 2.0V for 
periods <20 ns. 

3. Maximum DC voltage on Vpp may overshoot to + 14.0V for periods <20 ns. Maximum DC voltage on RP# or Ag may 
overshoot to 13.5V for periods < 20 ns. 

4. Output shorted for no more than one second. No more than one output shorted at a time. 

5. 10% Vcc specifications reference the 28F400BX-60/28F004BX-60 in their standard test configuration, and the 
28F400BX-80/28F004BX-80. 

6. 5% Voc specifications reference the 28F400BX-60/28F004BX-60 in their high speed test configuration. 


OPERATING CONDITIONS 


Voc Supply Voltage (10%) 
Voc Voc Supply Voltage (5%) 


Voc = Voc Max 

Vin = Voc or GND 
Voc = Voc Max 
Vout = Vcc or GND 
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DC CHARACTERISTICS (Continued) 


locs 


Voc Deep Powerdown Current 


Voc Read Current for 
28F400BX Word-Wide 
and Byte-Wide Mode 
and 28F004BX 
Byte-Wide Mode 


Vcc Word/Byte Write Current | 1, 4 
Voc Block Erase Current 1,4 


Vcc Erase Suspend Current 1,2 


Vpp Standby Current 
Vpp Deep PowerDown Current 
Vpp Read Current 


Vpp Byte Write Current 


- oa Q 190 IO ae to: 
vu vu QO |O 19 Cc) 1 
= = mim i D |O 


Input High Voltage 


Output Low Voltage 


4-30 


Vpp Word Write Current 


Voc = Voc Max 
CE# = RP# = Vin 


CE# = RP# = Vcc +0.2V 
28F400Bx: 
BYTE# = Vcc +0.2V or GND 


f = 10 MHz, lout = OmA 
CMOS Inputs 


Voc = Vcc Max, CE# = Vi, 
f = 10 MHz, lout = OMA 
TTL Inputs 


mA | Word or Byte Write in Progress 


| mA. Block Erase in Progress 
koe Block Erase Suspended, 


CE# = Vin 


RP# = GND +0.2V 


Vpp = VpPH 
Word Write in Progress 
Vpp = VpPH 

Byte Write in Progress 


m 
m 
m 
m 
mA |Vpp = VpPH 
Block Erase in Progress 
pA |Vpp = VppH 
Block Erase Suspended 


Eee Cain a 


A 
A 
A 
A 
A 
A 
A 
A 
A 
V 
V 
V 
V 


Voc = Vcc Min 
lo. = 5.8mA 
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|___Parameter_——_| Notes | Min | Typ | Max Unit | Test Conditions 


VOH Output High Voltage 2.4 V | Voc = Voc Min 
lon = —2.5mA 
VHH 


ven, [Ve dung normal Operators [3 [oo] les}v[ 
[Veen [Vee during Eese/Wrte Operations | 7 [t14[v20|e| v | 
"veens | Vee during Erase/Wite Operations | 8 
Vico [Voc Erase/Wite Lock Votage —[ 
visa [RPS Unlock vonage 


EXTENDED TEMPERATURE OPERATING CONDITIONS 


| Symbol | Parameter 
Operating Temperature 
Voc Supply Voltage (10% 


Symbol] Parameter | Notes |Min| Typ | Max | Unit] TestConditions 


Input Load Current +1.0} pA | Voc = Voc Max 
Vin = Voc or GND 
Output Leakage Current . 1 +10] pA | Voc = Voc Max 
Vout = Vcc or GND 
1,3 1.5 | mA | Voc = Voc Max 
C 
100 | pw 
28F400BX: 
BYTE# = Vcc +0.2V or GND 


Ta [foals [wa [ree ano soa 


CE# = RP# = Voc +0.2V 


IccD 


Voc Deep Power-Down Current 
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DC CHARACTERISTICS: EXTENDED TEMPERATURE OPERATION (Continued) 


Voc Read Current for 28F400BX 
Word-Wide and Byte-Wide Mode f = 10 MHz, lout = OmA 
28F004BX Byte-Wide Mode CMOS Inputs 


Voc = Voc Max, CE# = Vi, 
f = 10 MHz, lout = OmA 
TTL Inputs 


Iocw Voc Word Write Current Pg AE ede 34 Peed arp Word Write in Progress 
Vcc Block Erase Current mA | Block Erase in Progress 


Icces | Vcc Erase Suspend Current mA | Block Erase Suspended, 
CE# = Vin 


Vcc Deep Power-Down Current RP# = GND +0.2V 


Vpp Word Write Current A | Vpp = VpppH 

Word Write in Progress 
Vpp Byte Write Current 1 A | Vpp = VppH 

Byte Write in Progress 
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DC CHARACTERISTICS: EXTENDED TEMPERATURE OPERATION (Continued) 


[Parameter [Notes] Min |Typ| Max [Unit] Test Conditions 


Vpp Block Erase Current 1 mA | Vpp = Vppy 

Block Erase in Progress 
Vpp Erase Suspend Current 1 200 uA | Vpp = Vppy 

Block Erase Suspended 
RP# Boot Block Unlock 1,4 pA | RP# = Vip 
Current 


ee 

ig [Ae nteigentideniiorGurent | 1 || | 600 [wa |Ap= Vp 
Mo [Aeintcigentieniior Curent | [aref | 130 fv] 
Vu [nputLowvotage =| ~S—*d os 

Vee [Input ar 

i ce a 

i clan a C1 9 

ae os | 2 [oo] | os 


Vip 

ViL 

VIH 

VoL 

VOH 

VppL Vpp during Normal Operations 3 0.0 | 
VPPH 

VLKO 

VHH 


Input High Voltage 


Veen [Vor dung Erase/WiteOperaions| e | toe [120] ta2 | V_ 
Vico [VooErese/Wite Lock votgs | _[2o| [|v 
Misi [RP Uniockvotage (| ins) | 130 


[Symbol | Parameter 
Input Capacitance 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Vcc = 5.0V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (packages and speeds). 

2. Ioces is specified with the device deselected. If the device is read while in Erase Suspend Mode, current draw is the sum 
of Icces and Iccr. 

3. Block Erases and Word/Byte Writes are inhibited when Vpp = Vpp, and not guaranteed in the range between Vppy and 
VPPL- 

4. Sampled, not 100% tested. 

5. Automatic Power Savings (APS) reduces Iccr to less than 1 mA typical in static operation. 

6. CMOS Inputs are either Voc +0.2V or GND +0.2V. TTL Inputs are either Vj, or Vip. 

7. Vpp = 12.0V + 5% for applications requiring 100,000 block erase cycles. 

8. Vpp = 12.0V + 10% for applications requiring wider Vpp tolerances at 100 block erase cycles. 

9. For the 28F004BX address pin Ajo follows the Coyt capacitance numbers. 

10. Iocr typical is 25 mA for X16 Active Read Current. 
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STANDARD TEST CONFIGURATION(?) 


STANDARD 
AC INPUT/OUTPUT REFERENCE WAVEFORM 


2.4 => en < ort 
2.0 2.0 
INPUT TEST POINTS OUTPUT 
0.45 0.8 = . 0.8 


290451-14 


AC test inputs are driven at Voy (2.4 Vrt,) for a Logic “1” and Vo, 
(0.45 VtqL) for a logic “0”. Input timing begins at Vip (2.0 Vrz,_) and Vi 
(0.8 V7). Output timing ends at Vjy and Vj,. Input rise and fall times (10% 
to 90%) < 10 ns. 


HIGH SPEED TEST CONFIGURATION(2) 


HIGH SPEED 
AC INPUT/OUTPUT REFERENCE WAVEFORM 


3.0 => (ere (aut 
INPUT 1.5 <—— TEST POINTS ————> 4% 1.5 OUTPUT 
0.0 


290451-22 


AC test inputs are driven at 3.0V for a Logic “1” and 0.0V for a logic “0”. 
Input timing begins, and output timing ends, at 1.5V. Input rise and fall times 
(10% to 90%) < 10 ns. 


NOTES: 


STANDARD 
AC TESTING LOAD CIRCUIT 


DEVICE 


UNDER 
TEST 


290451-13 
C. = 100 pF 
C. Includes Jig Capacitance 
R_ = 3.3 KO 


HIGH SPEED 
AC TESTING LOAD CIRCUIT 


DEVICE 
UNDER 
TEST 


290451-21 


CL = 30 pF 
C, Includes Jig Capacitance 
Ri. = 3.3 KO 


1. Testing characteristics for 28F400BX-60/28F004BxX-60 in standard test configuration and 28F400BX-80/28F004BX-80. 
2. Testing characteristics for 28F400BX-60/28F004BX-60 in high speed test configuration. 
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28F400BX-60(4) 
ob 
Versions : 
Vcc + 10% 


| Symbol | Parameter _[Notes 
| Output Delay 

Output Delay 
taLay toe |OE* to Output Delay 


teHQz|tHz |CE# High to Output 
High Z 


OE # to Output LowZ| 3 


tGHaz|tpF |OE# High to Output 
High Z 


Output Hold from 
Addresses, 

CE # or OE# Change, 
Whichever is First 
CE# to BYTE# 
Switching 

Low or High 
BYTE # Switching 
High to Valid 
Output Delay 
BYTE# Switching 


Low to 
Output High Z 


NOTES: 

1. See AC Input/Output Reference Waveform for timing measurements. 

2. OE# may be delayed up to tce-tog after the falling edge of CE# without impact on toe. 

3. Sampled, not 100% tested. 

4. See High Speed Test Configuration. 

5. See Standard Test Configuration. 

6. teLqy, BYTE# switching low to valid output delay, will be equal to tayqy, measured from the time DQ;5/A.4 becomes 
valid. 
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EXTENDED TEMPERATURE OPERATION 
AC CHARACTERISTICS—Read Only Operations(') 


er aoe 
Output Delay 

Tisay [toe | Cer ouput Dei 
Output Delay 


| toe 
Cie 
Ste — 
High Z 
2 . 


Output Hold from 
Whichever is First 
High to Valid 

Low to 


to OE # to Output Low Z 
tGHaz OE # High to Output 
High Z 
Addresses, 
CE # or OE# Change, 
tELFL CE# to BYTE# 
tELFH Switching 
Low or High 
tEHOQV BYTE # Switching 
~ Output Delay 
Hest BYTE # Switching 
NOTES: 
1. See AC Input/Output Reference Waveform for timing measurements. 


Output High Z 


2. OE# may be delayed up to tce—-tog after the falling edge of CE# without impact on toe. 


3. Sampled, not 100% tested. 
4. See Standard Test Configuration. 


5. teLqy, BYTE# switching low to valid output delay, will be equal to tayqy from the time DQ15/A_ 4 becomes valid. 
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LEe-v 


ViH 


CE# (E) 
Vit 


Vin 


OE# (G) 
ViL 


Vin 
WE# (W) 


Vit 


Vin 


DATA (D/Q) 
Vit 


Voc POWER-UP 


~~» XXXXKYY 


HIGH Z 


DEVICE AND 


ADDRESS SELECTION OUTPUTS ENABLED 


ADDRESSES STABLE 


teLav 


teLav 


tcLax 
teLox 


—X@ 


tpHav 


DATA VALID 


tavaV 


VALID OUTPUT 


tou 


\ 


4 


STANDBY 


teHoz 


tcHaz 


ANNI 
hy 


Veg POWER-DOWN 


KX x) 


HIGH Z 
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12643 6 Ff 8 2 16 1312135 4 1316 


132 3.45 6: 7 & 8 WO trt2 15.1415 16 
FREQUENCY (MHz) FREQUENCY (MHz) 
290451-26 290451-27 
Figure 17. lcc (RMS) vs Frequency Figure 18. icc (RMS) vs Frequency 
(Vcc = 5.5V for x16 Operation 


(Vcc = 5.5V) for x8 Operation 


Tace (ns) 


—O— 28F400BX/28F004BX-60 
—O— 28F400BX/28F004BX-80 


OUTPUT CAPACITANCE (pF) 


290451-28 
Figure 19. Tacc vs Output Load Capacitance 
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6-7 


DEVICE 


STANDBY opRes srLReron DATA VALID STANDBY 
Vin + oe 
ADDRESSES (A) XX V, XX K { ADDRESSES STABLE } XXX 
* ysttayg ai PAA 
tavav 
Vin 
CE# (C) 
Vv i war eat. 
7 tavey = feet — 
Va am Co - 
OE# (G) 
V, _—8 = = 
: ‘ELFL a ‘GHaz 
Vin int 
BYTE# (F) 
Vit 
ViH . ‘ 
HIGH Z -/ DATA OUTPUT SOA HIGH Z 
DATA (DQ) -DQ, ) re wae OUTPUT ON 
‘ tavav 
/ DATA HIGH Z 
DATA (DQ,-DQ,,) = (fae . h 


t 
AVQV 
Loz 


f DATA \ wich 2 ADDRESS sai 
OUTPUT 
DQ 5 /A, \ ON DQ. / C INPUT 
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AC CHARACTERISTICS—WE # Controlled Write Operations(?) 


28F400BX-60(°) 
a 


Versions 
Ver + 10% 28F400BX-60(19) | 28F400BX-80(10) 
ce 28F004BX-60(19) | 28F004BX-80(10) 
| Symbol Parameter __| Notes Min 


Write Cycle Time 
tpHWL RP# High 
Recovery to 
WE # Going Low 
te_wL |tcs |CE# Setup to WE# 
Going Low 
tpHHWH RP# VupH Setup to 
WE # Going High 


215 


1 

typs | Vpp Setup to WE # 1 
Going High 

tas |Address Setup to 
WE # Going High 


Data Setup to WE # 
Going High 
twLWH twp WE # Pulse Width 


Data Hold from 

WE # High 

twHax |taH |Address Hold from 
WE # High 

twHEH |tcH |CE# Hold from 
WE # High 


tweH| WE# Pulse 
Width High 


BSS 


( wake 
>) 


anil 
2) 


00 
00 
10 
10 
10 


Duration of 
Word/Byte 


= 
7) 


Programming 
Operation 


twHave Duration of Erase 
Operation (Boot) 


Duration of Erase 
Operation 
(Parameter) 


tpHH | RP # Vu Hold 
from Valid SRD 


~ ts 
co 


Boot-Block 100 


Relock Delay 


= 
U 
4 
w 
D 


> 
& 
ro) 
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AC CHARACTERISTICS—WE # Controlled Write Operations(1) (Continued) 


NOTES: 

1. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
characteristics during Read Mode. 

2. The on-chip WSM completely automates program/erase operations; program/erase algorithms are now controlled inter- 
nally which includes verify and margining operations. 

3. Refer to command definition table for valid Ajj. 

4. Refer to command definition table for valid Dyy. 

5. Program/Erase durations are measured to valid SRD data (successful operation, SR.7 = 1). 

6. For Boot Block Program/Erase, RP # should be held at Vy} until operation completes successfully. 

7. Time tpyppR is required for successful relocking of the Boot Block. 

8. Sampled but not 100% tested. 

9. See High Speed Test Configuration. 

10. See Standard Test Configuration. 


BLOCK ERASE AND WORD/BYTE WRITE PERFORMANCE Vpp = 12.0V +5% 


28F400BX-60 28F400BX-80 
Parameter 28F004BX-60 28F004BX-80 
| min | Typ) | Max | Min | Typ) | Max | 

Boot/Parameter — 1.0 7 1.0 7 

Block Erase Time 

Main Block 2.4 14 2.4 14 

Erase Time 

Main Block Byte 1.2 4.2 y E°s 

Program Time 

Main Block Word 2.1 a4 

Program Time 


NOTES: 
1, 2a'0 
2. Excludes System-Level Overhead. 


BLOCK ERASE AND WORD/BYTE WRITE PERFORMANCE Vpp = 12.0V +10% 


28F400BX-80 
28F004BX-80 


Main Block 


Erase Time 


2. Excludes System-Level Overhead. 
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EXTENDED TEMPERATURE OPERATION 
AC CHARACTERISTICS—WE # Controlled Write Operations(’) 


T28F400BX-80(9) 
T28F004BX-80(9) 


Write Cycle Time 


RP # High Recovery to 
WE # Going Low 


tcs CE # Setup to WE # Going Low 


RP # Vu Setup to WE # 
Going High 


Vpp Setup to WE # Going High 


tas Address Setup to WE # 
Going High 
/ tovwwH | tos Data Setup to WE # Going High 
WE # Pulse Width 


P 
Data Hold from WE # High 
Address Hold from WE # High 


CE # Hold from WE# High 


WE # Pulse Width High 


Duration of Word/Byte 
Programming Operation 


Duration of Erase Operation (Boot) 


oe 
juan] | Duration of Erase Operation 
(Parameter) 
| twHava | | Duration of Erase Operation (Main 
Vpp Hold from Valid SRD 
RP# Viyy Hold from Valid SRD 
beep Sloe Boot-Block Relock Delay 
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EXTENDED TEMPERATURE OPERATION 
AC CHARACTERISTICS—WE # Controlled Write Operations(1) (Continued) 


NOTES: 

1. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
characteristics during Read Mode. 

2. The on-chip WSM completely automates program/erase operations; program/erase algorithms are now controlled inter- ‘ 
nally which includes verify and margining operations. 

3. Refer to command definition table for valid Ajj. 

4. Refer to command definition table for valid Diy. 

5. Program/Erase durations are measured to valid SRD data (successful operation, SR.7 = 1). 

6. For Boot Block Program/Erase, RP # should be held at Vy until operation completes successfully. 

7. Time tpypR is required for successful relocking of the Boot Block. 

8. Sampled but not 100% tested. 

9. See Standard Test Configuration. 


EXTENDED TEMPERATURE OPERATION 
BLOCK ERASE AND WORD/BYTE WRITE PERFORMANCE Vpp = 12.0V +5% 


T28F400BX-80 
Parameter T28F004BX-80 


Boot/Parameter 
Block Erase Time 


Main Block 
Erase Time 
Main Block Byte 
Program Time 
Main Block Word 
Program Time 


NOTES: 
1. 25°C 
2. Excludes System-Level Overhead. 
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~) 
ro) 
Voc POWER-UP = WRITE PROGRAM OR __‘VALID ‘ieeien ate (PROGRAM) = AUTOMATED PROGRAM READ STATUS WRITE READ ARRAY z 
& STANDBY ERASE SETUP COMMAND OR ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER DATA COMMAND ° 
Win wy 
$3 + aaa fw XXX XX i XXX) XXX XX \/ XX \/ XXX 64 \/ XX Xx \/ XXX x) >< ; 
OSS Sage is \ ‘n DLR K KKK KK KY o 
w 
tavav tavWH tWHAX “ 
Vin & 
CE# (E) S 
Vit Ps 
ELWL tWHEH ‘ >< 
Vin = 
OE# (GC) w 
Vit 
twHav1,2,3,4 
Vin 
WE# (W) 
Vi 
‘ovwH E 
Vie 
vot Ln) > 
= ‘ovPH 
Vn A == 
/ ‘ 
6.5V 
Vin 
RP# (P) 
Vit 
, fovvn | 3 
PPH \AAA/AA/AAAAAAAAAAAA FAV AVAVAVAVAVAVAVAVAVAVAVAVAVAVAVAVAVAY, , 
0.0-0.0-0- 0.00000 0000009 XXX AKXAXAXAAK AKAM) 
«ARBRE ES |S 
v, LOY XKXRXXXXKKKKKK a” | 
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AC CHARACTERISTICS—CE #-CONTROLLED WRITE OPERATIONS(1, 9) 
: 28F400BX-60(10) 
enon) | ince niel 
Versions . 
ne 28F400BX-60(11) | 28F400BX-80(11) 
~ 28F004BX-60(11) | 28F004BX-80(11) 
Parameter Not 


Write Cycle Time 


RP# High 


N 
@ 
3] 


| Max | Min | Max | Min | Max 
ieee GS 


Recovery 
to CE# Going Low 


WE # Setup to 
CE # Going Low 
RP# Vin Setup to 
CE # Going High 


oe 
= 
fo 
m 
Td 


typs | Vpp Setup to CE # 
Going High 

tas | Address Setup to 
CE # Going High 

Data Setup to 

CE # Going High 

tcp |CE# Pulse Width 


Data Hold from 
CE # High 


tay | Address Hold 
from CE # High 


WE # Hold from 
CE# High 


teEHEL | tcpH|CE# Pulse 
Width High 


Duration of Word/ 
Byte Programming 
Operation 


Duration of Erase 
Operation (Boot) 


Duration of Erase 


-~ 
m 
es 
m 
ale 


10 


oO 


—_ 
© 


10 
0 


ae 
=) 


Operation 
(Parameter) 


Duration of Erase 
Operation (Main) 
L |typH| Vpp Hold from 
Valid SRD 
RP# Vuy Hold © 
from Valid SRD 


Boot-Block 
Relock Delay 


mek —_ 
© 


100 100 


eae oat oe one ae ar | = 
U m m > < Uv i> 
ae cia | . : a | 3 a |S 
yD s x x< oi a ig - |< 


a 
oO 
io) 
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AC CHARACTERISTICS—CE #-CONTROLLED WRITE OPERATIONS(!, 9) (Continued) 


NOTES: 

1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of CE# and WE# in systems where 
CE ¥# defines the write pulse-width (within a longer WE# timing waveform), all set-up, hold and inactive WE # times should 
be measured relative to the CE # waveform. 

2, 3,4, 5, 6, 7, 8: Refer to AC Characteristics notes for WE #-Controlled Write Operations. 

9. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
Characteristics during Read Mode. 

10. See High Speed Test Configuration. 

11. See Standard Test Configuration. 


EXTENDED TEMPERATURE OPERATION 
AC CHARACTERISTICS—CE #-CONTROLLED WRITE OPERATIONS(, 9) 


T28F400BX-80(10) 
T28F004BX-80(19) 


Wite Cyele Time 


| tpg RP# High Recovery to CE # Going Low 
E# Setup to CE# Going Low 
RP# Vip Setup to CE# Going High 
Vpp Setup to CE # Going High 
| taveH | tas | Address Setup to CE # Going High 
!toven | tos | Data Setup to CE # Going High 
| teteH | tcp | CE# Pulse Width 
| teHox | ton | Data Hold from CE # High 
[tan 


= 


tEHAX Address Hold from CE # High 


tas 
tcp 
tbH 
taH 
Mteuwn | twa | WE# Hold from CE# High 


tcpy | CE# Pulse Width High 


uration of Word/Byte Programming 


ee peration 
[teHove | 

ae 

Se 


@) 


OU 


0 


uration of Erase Operation (Boot) 
Duration of Erase Operation (Parameter) 
Duration of Erase Operation (Main) 


Vpp Hold from Valid SRD 
RP # Vy Hold from Valid SRD 
| tpHsrR |_| Boot-Block Relock Delay 


NOTES: 

1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of CE# and WE# in systems where 
CE# defines the write pulse-width (within a longer WE # timing waveform), all set-up, hold and inactive WE# times should 
be measured relative to the CE# waveform. 

2, 3, 4, 5, 6, 7, 8: Refer to AC Characteristics for WE #-Controlled Write Operations. 

9. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
Characteristics during Read Mode. 

10. See Standard Test Configuration. 
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Lv-v 


WRITE 


Voc POWER-UP = WRITE PROGRAM OR __—*VALID ADDRESS & DATA(PROGRAM) |= AUTOMATED PROGRAM READ STATUS WRITE READ ARRAY 


& STANDBY ERASE SETUP COMMAND OR ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER DATA COMMAND 
; . 
1H (YY XX XK KKK KKK X) eeeee. V/V/ XXX p. {XX xX \/ XK KX \/ e4 
wows BRK DRS RR 
taVAV taVEH tEHAX 
Vin 
WE# (W) 


Vi ‘ 
WLEL teHWH 


Vin 
OE# (G) 
Vit 
Vin 
CE# (E) 
‘u mari 


toveH 
DATA (D/Q) i { 


Vit HEL 


tenov1,2,3,4 


6.5V 
Vin 
RP# (P) 
Vit 
' tov 
PPH XX XY YY YY XY YY My A / XXXK XY XY re" KX XY KX V 
vn AXON RY nent 
PP iy COO6 \/ \ XYXXK XK YY VAVAVAVAVAVAVAVAVATAVAVAVAVAVAYAVAY, 
,, LY XXX KEX KEK 
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28F400BX-T/B, 28FO04BX-T/B intel : 
ORDERING INFORMATION 


fez petrispopopeyxt-trpeyo 
—_—_—_—_ 
ay ar i ACCESS SPEED (ns) 


OPERATING TEMPERATURE PACKAGE 60ns 
T = EXTENDED TEMP — = STANDARD 56 LEAD TSOP 80 ns 
BLANK = COMMERCIAL TEMP PA = 44 LEAD PSOP 


TB = 44 LEAD PSOP, EXTENDED TEMP 
290451-18 


VALID COMBINATIONS: 

E28F400BX-T60 PA28F400BX-T60 

E28F400BX-B60 PA28F400BX-B60 

E28F400BX-T80 PA28F400BX-T80 TE28F400BX-T80 TB28F400BX-T80 
E28F400BX-B80 PA28F400BX-B80 TE28F400BX-B80 TB28F400BX-B80 


| fefz2petrjofopsfeyxi-rpefo| 
Mi SeTR ss ee a 0 
"ge 7 ACCESS SPEED (ns) 


OPERATING TEMPERATURE PACKAGE 58 ae 
T = EXTENDED TEMP E = STANDARD 40 LEAD TSOP an 
BLANK = COMMERCIAL TEMP hid 


VALID COMBINATIONS: 
E28F004BxX-T60 E28F004BxX-T80 TE28F004BX-T80 
E28F004BX-B60 E28F004BX-B80 TE28F004BX-B80 


ADDITIONAL INFORMATION Order Number 
28F200BX/28F002BX Datasheet 290448 
28F200BXL/28F002BXL Datasheet 290449 
28F400BXL/28F004BXL Datasheet 290450 
AP-363 “Extended Flash BIOS Design for Portable Computers” 292098 
ER-28 “ETOX-IIl Flash Memory Technology” 204012 
ER-29 “The Intel 2/4-MBit Boot Block Flash Memory Family” 294013 


REVISION HISTORY 


| Number | Description 
Original Version 


Removed -70 speed bin. 
Integrated -70 characteristics into -60 speed bin. 
Added Extended Temperature characteristics. 

Modified BYTE # Timing Diagram. 


PWD renamed to RP# for JEDEC standardization compatibility. 
Combined Voc Read current for 28F400BX Word-Wide Mode and Byte-Wide Mode and 
28F004BX Byte-Wide Mode in DC Characteristics tables. 

Added Boot Black Unlock Current specifications in DC Characteristics tables. 

Improved Iccr and Iccw in DC Characteristics: Extended Temperature Operation table. 


Improved tavav, tavav; teLav: taLav: teHaz: teHaz: tFHav and tFLqz specifications for 
Extended Temperature Operations AC Characteristics—Read and Write Operations. 
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4-MBIT (256K x 16, 512K x 8) LOW POWER BOOT BLOCK 
FLASH MEMORY FAMILY 


m Low Voltage Operation for Very Low 


Power Portable Applications 
—Vecc = 3.3V +0.3V 


x8/x16 Input/Output Architecture 

— 28F400BX-TL, 28F400BX-BL 

— For High Performance and High 
integration 16-bit and 32-bit CPUs 


x8-only Input/Output Architecture 

— 28F004BX-TL, 28F004BX-BL 

— For Space Constrained 8-bit 
Applications 


Optimized High Density Blocked 
Architecture 

— One 16-KB Protected Boot Block 
— Two 8-KB Parameter Blocks 

— One 96-KB Main Block | 

— Three 128-KB Main Blocks 

— Top or Bottom Boot Locations 


Extended Cycling Capability 
— 10,000 Block Erase Cycles 


Automated Word/Byte Write and Block 
Erase 

— Command User Interface 

— Status Registers 

— Erase Suspend Capability 


SRAM-Compatible Write Interface 


October 1993 
Order Number: 290450-003 


Automatic Power Savings Feature 


— 0.8 mA typical Icc Active Current in 


Static Operation 


Very High-Performance Read 
— 150 ns Maximum Access Time 
— 65 ns Maximum Output Enable Time 


Low Power Consumption 
— 15 mA Typical Active Read Current 


Reset/Deep Power-Down Input: 
— 0.2 »A Icc Typical 
— Acts as Reset for Boot Operations 


Write Protection for Boot Block 


Hardware Data Protection Feature 
— Erase/Write Lockout During Power 
Transitions 


Industry Standard Surface Mount 

Packaging 

— 28F400BX: JEDEC ROM 
Compatible 
44-Lead PSOP 
56-Lead TSOP 

— 28F004BX: 40-Lead TSOP 


12V Word/Byte Write and Block Erase 
—Vpp = 12V +5% Standard 


ETOX Ill Flash Technology 
— 3.3V Read 
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Intel’s 4-Mbit Low Power Flash Memory Family is an extension of the Boot Block Architecture which includes 
block-selective erasure, automated write and erase operations and standard microprocessor interface. The 
4-Mbit Low Power Flash Memory Family enhances the Boot Block Architecture by adding more density and 
blocks, x8/x16 input/output control, very low power, very high speed, an industry standard ROM compatible 
pinout and surface mount packaging. The 4-Mbit low power flash family opens a new capability for 3V battery- 
operated portable systems and is an easy upgrade to Intel’s 2-Mbit Low Power Boot Block Flash Memory 
Family. 


The Intel 28F400BX-TL/BL are 16-bit wide low power flash memory offerings. These high density flash memo- 
ries provide user selectable bus operation for either 8-bit or 16-bit applications. The 28F400BX-TL and | 
28F400BX-BL are 4,194,304-bit non-volatile memories organized as either 524,288 bytes or 262,144 words of 
information. They are offered in 44-Lead plastic SOP and 56-Lead TSOP packages. The x8/x16 pinout con- 
forms to the industry standard ROM/EPROM pinout. The Intel 28FO04BX-TL/BL are 8-bit wide low power 
flash memories with 4,194,304 bits organized as 524,288 bytes of information. They are offered in a 40-Lead 
TSOP package, which is ideal for space-constrained portable systems. 


These devices use an integrated Command User Interface (CUI) and Write State Machine (WSM) for simplified 
word/byte write and block erasure. The 28F400BX-TL/28F004BX-TL provide block locations compatible with 
Intel’s Low Voltage MCS-186 family, i886™, i486™ microprocessors. The 28F400BX-BL/28F004BX-BL pro- 
vide compatibility with Intel’s 80960KX and 80960SX families as well as other low voltage embedded micro- 
processors. 


The boot block includes a data protection feature to protect the boot code in critical applications. With a 
maximum access time of 150 ns, these 4-Mbit low power flash devices are very high performance memories at 
3.3V which interface to a wide range of low voltage microprocessors and microcontrollers. A deep power- 
down mode lowers the total Vcc power consumption to 0.66 .W which is critical in handheld battery powered 
systems such as Handy Cellular Phones. For very high speed applications using a 5V supply, refer to the Intel 
28F400BX-T/B, 28F004BX-T/B 4-Mbit Boot Block Flash Memory family datasheet. 


Manufactured on Intel’s 0.8 micron ETOX Ill process, the 4-Mbit flash memory family provides world class 
quality, reliability and cost-effectiveness at the 4 Mbit density level. 
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1.0 PRODUCT FAMILY OVERVIEW 


Throughout this datasheet 28F400BX-L refers to 
both the 28F400BX-TL and 28F400BX-BL devices 
and 28F004BX-L refers to both the 28FO004BX-TL 
and 28F004BX-BL devices. The 4-Mbit flash family 
refers to both the 28F400BX-L and 28F004BxX-L 
products. This datasheet comprises the specifica- 
tions for four separate products in the 4-Mbit flash 
family, Section 1 provides an overview of the 4-Mbit 
flash family including applications, pinouts and pin 
descriptions. Sections 2 and 3 describe in detail the 
specific memory organizations for the 28F400BX-L 
and 28F004BX-L products respectively, Section 4 
combines a description of the family’s principles of 
operations. Finally section 5 describes the family’s 
operating specifications. 


Product Family 


x8/x16 Products x8-Only Products 
28F400BX-TL 28F004BX-TL 
28F400BX-BL 28F004BX-BL 


1.1 Main Features 


The 28F400BX-L/28F004BX-L boot block flash 
memory family is a very high performance 4-Mbit 
(4,194,304 bit) memory family organized as either 
256 KWords (262,144 words) of 16 bits each or 
512 Kbytes (524,288 bytes) of 8 bits each. 


Seven Separately Erasable Blocks including a 
Hardware-Lockable boot block (16,384 Bytes), 
two parameter blocks (8,192 Bytes each) and four 
main blocks (1 block of 98,304 Bytes and 3 blocks 
of 131,072 Bytes) are included on the 4-Mbit family. 
An erase operation erases one of the main blocks in 
typically 3.4 seconds and the boot or parameter 
blocks in typically 2.0 seconds, independent of the 
remaining blocks. Each block can be independently 
erased and programmed 10,000 times. 


The Boot Block is located at either the top 
(28F400BX-TL, 28FO04BX-TL) or the bottom 
(28F400BX-BL, 28FO04BX-BL) of the address map 
in order to accommodate different microprocessor 
protocols for boot code location. The hardware 
lockable boot block provides the most secure 
code storage. The boot block is intended to store 
the kernel code required for booting-up a system. 
When the RP# pin is between 11.4V and 12.6V the 
boot block is unlocked and program and erase oper- 
ations can be performed. When the RP ¥ pin is at or 
below 4.1V the boot block is locked and program 
and erase operations to the boot block are ignored. 
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28F400BX-TL/BL, 28F004BX-TL/BL 


The 28F400BX-L products are available in the 
ROM/EPROM compatible pinout and housed in the 
44-Lead PSOP (Plastic Small Outline) package and 
the 56-Lead TSOP (Thin Small Outline, 1.2mm thick) 
package as shown in Figures 3 and 4, The 
28F004BX-L products are available in the 40-Lead 
TSOP (1.2mm thick) package as shown in Figure 5. 


The Command User Interface (CUI) serves as the 
interface between the microprocessor or microcon- 
troller and the internal operation of the 28F400BX-L 
and 28F004BX-L flash memory products. 


Program and Erase Automation allow program 
and erase operations to be executed using a two- 
write command sequence to the CUI. The internal 
Write State Machine (WSM) automatically executes 
the algorithms and timings necessary for program 
and erase operations, including verifications, there- 
by unburdening the microprocessor or microcontrol- 
ler. Writing of memory data is performed in word or 
byte increments for the 28F400BX-L family and in 
byte increments for the 28FO04BX-L family typically 
within 11 ps. 


The Status Register (SR) indicates the status of the 
WSM and whether the WSM successfully completed 
the desired program or erase operation. 


Maximum Access Time of 150 ns (TACC) is 
achieved over the commercial temperature range 
(0°C to + 70°C), Voc supply voltage range (3.0V to 
3.6V, 4.5V to 5.5V) and 50 pF output load. 


lpp Program current is 40 mA for x16 operation 
and 30 mA for x8 operation. Ipp Erase current is 
30 mA maximum. Vpp erase and programming 
voltage is 11.4V to 12.6V (Vpp = 12V +5%) un- 
der all operating conditions. 


Typical Icc Active Current of 15 mA is achieved 
for the x16 products and the x8 products. 


The 4-Mbit flash family is also designed with an Au- 
tomatic Power Savings (APS) feature to minimize 
system battery current drain and allow for very low 
power designs. Once the device is accessed to read 
the array data, APS mode will immediately put the 
memory in static mode of operation where Icc active 
current is typically 0.8 mA until the next read is initia- 
ted. 7 


When the CE# and RP# pins are at Vcc and the 
BYTE# pin (28F400BX-L-only) is at either Voc or 
GND the CMOS Standby mode is enabled where 


Ioc is typically 45 wA. 
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A Deep Power-Down Mode is enabled when the 
PWD pin is at ground minimizing power consumption 
and providing write protection during power-up con- 
ditions. I¢¢ current during deep power-down mode 
is 0.20 vA typical. An initial maximum access time 
or Reset Time of 700 ns is required from RP# 
switching until outputs. are valid. Equivalently, the 
device has a maximum wake-up time of 580 ns until 
writes to the Command User Interface are recog- 
nized. When RP # is at ground the WSM is reset, the 
Status Register is cleared and the entire device is 
protected from being written to. This feature pre- 
vents data corruption and protects the code stored 
in the device during system reset. The system Reset 
pin can be tied to RP# to reset the memory to nor- 
mal read mode upon activation of the Reset pin. 


When the CPU enters reset mode, it expects to read 


the contents of a memory location. Furthermore, 
with on-chip program/erase automation in the 
4-Mbit family and the RP # functionality for data pro- 
tection, when the CPU is reset and even if a program 
or erase command is issued, the device will not rec- 
ognize any operation until RP # returns to its normal 
state. | 


For the 2SF400BX-L, Byte-wide or Word-wide in- 
put/Output Control is possible by controlling the 
BYTE# pin. When the BYTE# pin is at a logic low 
the device is in the byte-wide mode (x8) and data is 
read and written through DQ[0:7]. During the byte- 
wide mode, DQ[8:14] are tri-stated and DQ15/A—1 
becomes the lowest order address pin. When the 
BYTE# pin is at a logic high the device is in the 
word-wide mode (x16) and data is read and written 
through DQ[0:15]. 


1.2 Applications 


The 4-Mbit low power boot block flash memory fami- 
ly combines high density, very low power, high per- 
formance, cost-effective flash memories with block- 
ing and hardware protection capabilities. Its flexibility 
and versatility will reduce costs throughout the prod- 
uct life cycle. Flash memory is ideal for Just-In-Time 
production flow, reducing system inventory and 
costs, and eliminating component handling during 
the production phase. During the product life cycle, 
when code updates or feature enhancements be- 
come necessary, flash memory will reduce the up- 
date costs by allowing either a user-performed code 
change via floppy disk or a remote code change via 
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a serial link. The 4-Mbit flash family provides full 
function, blocked flash memories suitable for a wide 
range of applications. These applications include 
Extended PC BIOS and ROM-abie applications 
storage, Handy Digital Cellular Phone program 
and data storage and various other low power em- 


bedded applications where both program and data 
storage are required. 


Portable systems such as Notebook/Palmtop com- 
puters, are ideal applications for the 4-Mbit low pow- 
er flash products. Portable and handheld personal 
computer applications are becoming more complex 
with the addition of power management software to 
take advantage of the latest microprocessor tech- 
nology, the availability of ROM-based application 
software, pen tablet code for electronic hand writing, 
and diagnostic code. Figure 1 shows an example of 
a 28F400BX-TL application. 


This increase in software sophistication augments 
the probability that a code update will be required 
after the Notebook is shipped. The 4-Mbit flash 
products provide an inexpensive update solution for 
the notebook and handheld personal computers 
while extending their product lifetime. Furthermore, 
the 4-Mbit flash products’ deep power-down mode 
provides added flexibility for these battery-operated 
portable designs which require operation at very low 
power levels. 


The 4-Mbit low power flash products also provide 
excellent design solutions for Handy Digital Cellular 
Phone applications requiring low voltage supply, 
high performance, high density storage capability 
coupled with modular software designs, and a small 
form factor package (x8-only bus). The 4-Mbit’s 
blocking scheme allows for an easy segmentation of 
the embedded code with; 16-Kbytes of Hardware- 
Protected Boot code, 4 Main Blocks of program 
code and 2 Parameter Blocks of 8-Kbytes each for 
frequently updatable data storage and diagnostic 
messages (e.g., phone numbers, authorization 
codes). Figure 2 is an example of such an applica- 
tion with the 28FO04BX-TL. 


These are a few actual examples of the wide range 
of applications for the 4-Mbit low power Boot Block 
flash memory family which enable system designers 
achieve the best possible product design. Only your 
imagination limits the applicability of such a versatile 
low power product family. 
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82360SL RESET# 


Controller 


GPIO 
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80386SL ROMCSO# CE# 
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Bo a Fa 


ROM 16/8# 
290450-7 


Figure 1. 28F400BX-L Interface to INTEL386SL 3.3V Microprocessor Superset 
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Figure 2. 28F004BX-L Interface to INTEL 80L188EB Low Voltage 8-bit Embedded Microprocessor 
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1.3 Pinouts 


The 28F400BX-L 44-Lead PSOP pinout follows 
the industry standard ROM/EPROM pinout as 
shown in Figure 3 and provides an upgrade for the 
28F200BX-L Low Power Boot Block flash memory 
family. Furthermore, the 28F400BX-L 56-Lead 


27C400 


~ intel. 


TSOP pinout shown in Figure 4 provides density up- 
grades to future higher density boot block memories. 


The 28F004BX-L 40-Lead TSOP pinout shown in 
Figure 5 is 100% compatible and provides a density 
upgrade for the 28F002BX-L 2-Mbit Low Power Boot 
Block flash memory family. 


270400 


28F400BX-—L 
44 LEAD PSOP A16 


0.525” x 1.110” 
TOP VIEW 


BYTE #/Vpp 
GND 
DQ45/A_ 
DQ7 
DQi4 
DQ¢ 
DQi3 
DQs 
DQi2 
DQ, 
Voc 
290450-24 


Figure 3. PSOP Lead Configuration for x8/x16 28F400BX-L 
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28F400BX 
56-LEAD TSOP 
14mm x 20mm 


TOP VIEW 


Figure 4. TSOP Lead Configuration for x8 28F400BX-L 


O 


28F004BX 
40-LEAD TSOP 


OON DUP WHY 


10mm x 20mm 
TOP VIEW 


Figure 5. TSOP Lead Configuration for x8 28F004BX-L 
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1.4 Pin Descriptions for x8/x16 28F400BX-L 


Type Name and Function 


ADDRESS INPUTS for memory addresses. Addresses are internally latched 
during a write cycle. 


ADDRESS INPUT: When Ag is at 12V the signature mode is accessed. During this 
mode Ao decodes between the manufacturer and device ID’s. When BYTE # is at 
a logic low only the lower byte of the signatures’ are read. DQ;5/A_— is a don't 

care in the signature mode when BYTE # is low. 


DATA INPUTS/OUTPUTS: Inputs array data on the second CE # and WE# cycle 
during a program command. Inputs commands to the command user interface 
when CE # and WE # are active. Data is internally latched during the write and 
program cycles. Outputs array, Intelligent Identifier and status register data. The 
data pins float to tri-state when the chip is deselected or the outputs are disabled. 


DATA INPUT/OUTPUTS: Inputs array data on the second CE# and WE# cycle 
during a program command. Data is internally latched during the write and program 
cycles. The data pins float to tri-state when the chip is deselected or the outputs 
are disabled as in the byte-wide mode (BYTE # = “0’’). In the byte-wide mode 
DQ5/A— 4 becomes the lowest order address for data output on DQ9-DQz7. 


CHIP ENABLE: Activates the device’s control logic, input buffers, decoders and 
sense amplifiers. CE # is active low; CE # high deselects the memory device and 
reduces power consumption to standby levels. If CE# and RP# are high, but not 

at a CMOS high level, the standby current will increase due to current flow through 
the CE# and RP # input stages. 


RESET/DEEP POWER-DOWN: Provides Three-State control. Puts the device in 
deep power-down mode. Locks the boot block from program/erase. 


When FP # is at logic high level and equals 4.1V maximum the boot block is 
locked and cannot be programmed or erased. 


When RP# = 11.4V minimum the boot block is unlocked and can be programmed 
or erased. 


When RP # is at a logic low level the boot block is locked, the deep power-down 
mode is enabled and the WSM is reset preventing any blocks from being 
programmed or erased, therefore providing data protection during power 
transitions. When RP # transitions from logic low to logic high, the flash memory 
enters the read-array mode. 


OE # OUTPUT ENABLE: Gates the device’s outputs through the data buffers during a 
read cycle. OE # is active low. 


WE # WRITE ENABLE: Controls writes to the Command Register and array blocks. 
WE # is active low. Addresses and data are latched on the rising edge of the WE # 
pulse. 
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1.4 Pin Descriptions for x8/x16 28F400BX-L (Continued) 


[symbol | Type 


BYTE# 


Name and Function 


BYTE # ENABLE: Controls whether the device operates in the byte-wide mode (x8) or 
the word-wide mode (x16). BYTE# = ‘0” enables the byte-wide mode, where data is 
read and programmed on DQ9-DQ7 and DQ;5/A_ 4 becomes the lowest order 
address that decodes between the upper and lower byte. DQg-DQy,, are tri-stated 
during the byte-wide mode. BYTE# = “1” enables the word-wide mode where data is 
read and programmed on DQp-DQj5. 


PROGRAM/ERASE POWER SUPPLY: For erasing memory array blocks or . 
programming data in each block. 
Note: Vpp < Vpp; max Memory contents cannot be altered. 
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1.5 Pin Descriptions for x8 28FO004BX-L 


| Symbol | Type | . Name and Function 


ADDRESS INPUTS for memory addresses. Addresses are internally latched during 
a write cycle. 


ADDRESS INPUT: When Ag is at 12V the signature mode is accessed. During this 
mode Ap decodes between the manufacturer and device ID’s. 


DATA INPUTS/OUTPUTS: Inputs array data on the second CE# and WE# cycle 
during a program command. Inputs commands to the command user interface 
when CE# and WE # are active. Data is internally latched during the write and 
program cycles. Outputs array, Intelligent Identifier and status register data. The 
data pins float to tri-state when the chip is deselected or the outputs are disabled. 


CHIP ENABLE: Activates the device’s control logic, input buffers, decoders and 
sense amplifiers. CE # is active low; CE # high deselects the memory device and 
reduces power consumption to standby levels. 


RESET/DEEP POWER-DOWN: Provides Three-State control. Puts the device in 
deep power-down mode. Locks the Boot Block from program/erase. 


When FP # is at logic high level and equals 4.1V maximum the Boot Block is locked 
and cannot be programmed or erased. 


When RP# = 11.4V minimum the Boot Block is unlocked and can be programmed 
or erased. 


When FP # is at a logic low level the Boot Block is locked, the deep power-down 
mode is enabled and the WSM is reset preventing any blocks from being 
programmed or erased, therefore providing data protection during power 
transitions. When RP # transitions from logic low to logic high, the flash memory 
enters the read-array mode. 


OE# OUTPUT ENABLE: Gates the device’s outputs through the data buffers during a 
read cycle. OE # is active low. 

WE# WRITE ENABLE: Controls writes to the Command Register and array blocks. WE # 
is active low. Addresses and data are latched on the rising edge of the WE# pulse. 


PROGRAM/ERASE POWER SUPPLY: For erasing memory array blocks or 
programming data in each block. | 
Note: Vpp < Vppi max Memory contents cannot be altered. 


Yoo |_| DEVICE POWER SUPPLY (av t0av,svi10%) 
Fano [ | GROUND: Foratinemalorouty, 
[Nc |_| NOGONNECT: Fin maybe diven orleifoatng, 
Pou |_| Bon USE PINE Pn should not be connected toanyting 
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2.1 28F400BX-L Memory Organization 


2.1.1 BLOCKING 


The 28F400BX-L uses a blocked array architecture 
to provide independent erasure of memory blocks. A 
block is erased independently of other blocks in the 
array when an address is given within the block ad- 
dress range and the Erase Setup and Erase Confirm 
commands are written to the CUI. The 28F400BX-L 
is a random read/write memory, only erasure is per- 
formed by block. 


2.1.1.1 Boot Block Operation and Data 
Protection 


The 16-Kbyte boot block provides a lock feature for 
secure code storage. The intent of the boot block is 
to provide a secure storage area for the kernel code 
that is required to boot a system in the event of pow- 
er failure or other disruption during code update. 
This lock feature ensures absolute data integrity by 
preventing the boot block from being written or 
erased when RP # is not at 12V. The boot block can 
be erased and written when RP# is held at 12V for 
the duration of the erase or program operation. This 
allows customers to change the boot code when 
necessary while providing security when needed. 
See the Block Memory Map section for address lo- 
cations of the boot block for the 28F400BX-TL and 
28F400BX-BL. 


2.1.1.2 Parameter Block Operation 


The 28F400BX-L has 2 parameter blocks (8 Kbytes 
each). The parameter blocks are intended to provide 
storage for frequently updated system parameters 
and configuration or diagnostic information. The pa- 
rameter blocks can also be used to store additional 
boot or main code. The parameter blocks however, 
do not have the hardware write protection feature 
that the boot block has. The parameter blocks pro- 
vide for more efficient memory utilization when deal- 
ing with parameter changes versus regularly blocked 
devices. See the Block Memory Map section for ad- 
dress locations of the parameter blocks for the 
28F400BX-TL and 28F400BX-BL. 


2.1.1.3 Main Block Operation 


Four main blocks of memory exist on _ the 
28F400BX-L (3 x 128-Kbyte blocks and 1 x 96-Kbyte 
blocks). See the following section on Block Memory 
Map for the address location of these blocks for the 
28F400BX-TL and 28F400BX-BL products. 
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2.1.2 BLOCK MEMORY MAP 


Two versions of the 28F400BX-L product exist to 
support two different memory maps of the array 
blocks in order to accommodate different microproc- 
essor protocols for boot code location. The 
28F400BX-TL memory map is inverted from the 
28F400BX-BL memory map. 


2.1.2.1 28F400BX-BL Memory Map 


The 28F400BX-BL device has the 16-Kbyte boot 
block located from O0000H to 01FFFH to accommo- 
date those microprocessors that boot from the bot- 
tom of the address map at OOOOOH. In the 
28F400BX-B the first 8-Kbyte parameter block re- 
sides in memory space from 02000H to O2FFFH. 
The second 8-Kbyte parameter block resides in 
memory space from O3000H to O3FFFH. The 
96-Kbyte main block resides in memory space from 
04000H to OFFFFH. The three 128-Kbyte main 
block resides in memory space from 10000H to 
1FFFFH, 20000H to 2FFFFH and 30000H to 
3FFFFH (word locations). See Figure 7. 


(Word Addresses) 
3FFFFH 
128-Kbyte MAIN BLOCK 


30000H 
2FFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128-Kbyte MAIN BLOCK 


10000H 
OFFFFH 


96-Kbyte MAIN BLOCK 


04000H 
O3FFFH 


03000H 
O2FFFH 


02000H 
01FFFH 


8-Kbyte PARAMETER BLOCK 


8-Kbyte PARAMETER BLOCK 


16-Kbyte BOOT BLOCK 


00000H 


Figure 7. 28F400BX-BL Memory Map 
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2.1.2.2 28F400BX-TL Memory Map 


~The 28F400BX-TL device has the 16-Kbyte boot 
block located from 3EQ00H to 3FFFFH to accommo- 
date those microprocessors that boot from the top 
of the address map. In the 28F400BX-T the first 
8-Kbyte parameter block resides in memory space 
from 3D000H to 3DFFFH. The second 8-Kbyte pa- 
rameter block resides in memory space from 
3COO0OH to 3CFFFH. The 96-Kbyte main block re- 
sides in memory space from 30000H to 3BFFFH. 
The three 128-Kbyte main blocks reside in memory 
space from 20000H to 2FFFFH, 10000H to 1FFFFH 
and OO000H to OFFFFH as shown in Figure 8. 


(Word Addresses) 


3FFFFH 
16-Kbyte BOOT BLOCK 
3E000H 


3DFFFH 


3D000H 
3CFFFH 


3CO00H 
3BFFFH 


8-Kbyte PARAMETER BLOCK 


8-Kbyte PARAMETER BLOCK 


96-Kbyte MAIN BLOCK 


30000H 
2FFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128-Kbyte MAIN BLOCK 


10000H 
OFFFFH 


128-Kbyte MAIN BLOCK 


00000H 


Figure 8. 28F400BX-TL Memory Map 
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3.0 28F004BX-L PRODUCTS DESCRIPTION 


Y¥391S1938 


Viva 


290450-3 


COMMAND 
USER 
INTERFACE 


1/0 LOGIC 
WRITE STATE PROGRAM/ ERASE 
MACHINE VOLTAGE SWITCH 


IDENTIFIER 
REGISTER 


STATUS 
REGISTER 
DATA 
LS COMPARATOR af 
Y-GATING/SENSING 


Cd Y3XIIdILINN 
INdLno 


POWER 
REDUCTION 
CONTROL 
Y-DECODER 
X-DECODER 


Figure 9. 28F004BX-L and Byte-Wide Block Diagram 
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3.1 28F004BX-L Memory Organization 


3.1.1 BLOCKING 


The 28FO04BX-L uses a blocked array architecture 
to provide independent erasure of memory blocks. A 
block is erased independently of other blocks in the 
array when an address is given within the block ad- 
dress range and the Erase Setup and Erase Confirm 
commands are written to the CUI. The 28FO04BX-L 
is a random read/write memory, only erasure is per- 
formed by block. 


3.1.1.1 Boot Block Operation and Data 
Protection 


The 16-Kbyte boot block provides a lock feature for 
secure code storage. The intent of the boot block is 
to provide a secure storage area for the kernel code 
that is required to boot a system in the event of pow- 
er failure or other disruption during code update. 
This lock feature ensures absolute data integrity by 
preventing the boot block from being programmed 
or erased when RP # is not at 12V. The boot block 
can be erased and programmed when RP # is held 
at 12V for the duration of the erase or program oper- 
ation. This allows customers to change the boot 
code when necessary while still providing security 
when needed. See the Block Memory Map section 
for address locations of the boot block for the 
28F004BX-TL and 28F004BX-BL. 


3.1.1.2 Parameter Block Operation 


The 28F004BX-L has 2 parameter blocks (8 Kbytes 
each). The parameter blocks are intended to provide 
storage for frequently updated system parameters 
and configuration or diagnostic information. The pa- 
rameter blocks can also be used to store additional 
boot or main code. The parameter blocks however, 
do not have the hardware write protection feature 
that the boot block has. Parameter blocks provide 
for more efficient memory utilization when dealing 
with small parameter changes versus regularly 
blocked devices. See the Block Memory Map sec- 
tion for address locations of the parameter blocks 
for the 28F004BX-TL and 28F004BX-BL. 


3.1.1.3 Main Block Operation 


Two main blocks of memory exist on the 
28F004BX-L (3 x 128-Kbyte blocks and 1 x 96-Kbyte 
blocks). See the following section on Block Memory 
Map for the address location of these blocks for the 
28F004BX-TL and 28F004BX-BL. 
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3.1.2 BLOCK MEMORY MAP 


Two versions of the 28FO004BX-L product exist to 
support two different memory maps of the array 
blocks in order to accommodate different microproc- 
essor protocols for boot code location. The 
28F004BX-TL memory map is inverted from the 
28F004BX-BL memory map. 


3.1.2.1 28F004BX-BL Memory Map 


The 28F004BX-BL device has the 16-Kbyte boot 
block located from O0000H to O3FFFH to accommo- 
date those microprocessors that boot from the bot- 
tom of the address map at OOOOOH. In the 
28F004BX-BL the first 8-Kbyte parameter block re- 
sides in memory from 04000H to O5FFFH. The sec- 
ond 8-Kbyte parameter block resides in memory 
space from O6000H to O7FFFH. The 96-Kbyte main 
block resides in memory space from O8000H to 
1FFFFH. The three 128-Kbyte main blocks reside in 
memory space from 20000H to 3FFFFH, 40000H to 
5FFFFH and 60000H to 7FFFH. See Figure 10. 


7FFFFH 


128-Kbyte MAIN BLOCK 


60000H 
5FFFFH 


128-Kbyte MAIN BLOCK 


40000H 
3FFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


96-Kbyte MAIN BLOCK 


08000H 
O7FFFH 


06000H 
O5FFFH 


04000H 
O3FFFH 


00000H 


Figure 10. 28F004BX-BL Memory Map 
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3.1.2.2 28F004BX-TL Memory Map 


The 28F004BX-TL device has the 16-Kbyte boot 
block located from 7COOOH to 7FFFFH to accom- 
modate those microprocessors that boot from the 
top of the address map. In the 28FO04BX-TL the first 
8-Kbyte parameter block resides in memory space 
from 7AOO0OH to 7BFFFH. The second 8-Kbyte pa- 
rameter block resides in memory space from 
78000H to 79FFFH. The 96-Kbyte main block re- 
sides in memory space from 60000H to 77FFFH. 
The three 128-Kbyte main blocks reside in memory 
space from 40000H to 5FFFFH, 20000H to 3FFFFH 
and OOOOOH to 1FFFFH. 


16-Kbyte BOOT BLOCK 


8-Kbyte PARAMETER BLOCK 


7FFFFH 


7COO00H 
7BFFFH 


7A000H 
79FFFH 


78000H 
77FFFH 


8-Kbyte PARAMETER BLOCK 


96-Kbyte MAIN BLOCK 


60000H 
5FFFFH 


128-Kbyte MAIN BLOCK 


40000H 
SFFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128-Kbyte MAIN BLOCK 


00000H 


Figure 11. 28FO04BX-TL Memory Map 
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4.0 PRODUCT FAMILY PRINCIPLES 
OF OPERATION 


Flash memory augments EPROM functionality with 
in-circuit electrical write and erase. The 4-Mbit flash 
memory family utilizes a Command User Interface 
(CUI) and internally generated and timed algorithms 
to simplify write and erase operations. 


The CUI allows for fixed power supplies during era- 
sure and programming, and maximum EPROM com- 
patibility. 


In the absence of high voltage on the Vpp pin, the 
4-Mbit flash family will only successfully execute the 
following commands: Read Array, Read Status Reg- 
ister, Clear Status Register and Intelligent Identifier 
mode. The device provides standard EPROM read, 
standby and output disable operations. Manufactur- 
er Identification and Device Identification data can 
be accessed through the CUI or through the stan- 
dard EPROM Ag high voltage access (Vip) (for 
PROM programmer equipment). 


The same EPROM read, standby and output disable 
functions are available when high voltage is applied 
to the Vpp pin. In addition, high voltage on Vpp al- 
lows write and erase of the device. All functions as- 
sociated with altering memory contents: write and 
erase, Intelligent Identifier read and Read Status are 
accessed via the CUI. 


The purpose of the Write State Machine (WSM) is to 
completely automate the write and erasure of the 
device. The WSM will begin operation upon receipt 
of a signal from the CUI and will report status back 
through a Status Register. The CUI will handle the 
WE # interface to the data and address latches, as 
well as system software requests for status while the 
WSM is in operation. 


4.1 28F400BX-L Bus Operations 


Flash memory reads, erases and writes in-system 
via the local CPU. All bus cycles to or from the flash 
memory conform to standard microprocessor bus 
cycles. 
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Table 1. Bus Operations for WORD-WIDE Mode (BYTE # = Vj) 


aT eee ee 
Fina ee et | a 
ee ee 
aS 


a ceceeee Ss 
vo | vc [|x | ooeer 


Intelligent Identifier (Device) | 4,5, 10 Pri eee Pe te 4470H 
4471H 


ie | ae Pe | a ee fe ee 
Table 2. Bus Operations for BYTE-WIDE Mode (BYTE # = Vj) 


| __Mode __| Notes | RP# | CE# | OE# | WEF | Ag | Ao | At | Vep | DQo.7 | DOs-14 


|| 
dae 
aS 
a 
ai 
N 


Toupaowabio || vw | wu | vw | vm | x | x [x | x | High | High2 
a a Ea 


Intelligent Identifier = = == Es X = ine z 
(Mfr) 

Intelligent Identifier | 4,5, 10 VIL Vit Vin | Vino | Vin | X X 70H High Z 
(Device) 2 H 


NOTES: 

1. Refer to DC Characteristics. 

2. X can be Vi, or Vip for control pins and addresses, Vpp, or Vppy for Vpp. 

3. See DC Characteristics for Vpp_, VppH, VHH, Vip voltages. 

4. Manufacturer and Device codes may also be accessed via a CUI write sequence. Ay-A17 = Vi_. 
5. Device ID = 4470H for 28F400BX-TL and 4471H for 28F400BX-BL. 

6. Refer to Table 4 for valid Dixy during a write operation. 
7 
8 
9 
1 


= 


. Command writes for Block Erase or Word/Byte Write are only executed when Vpp = YEnRE 
. TO write or erase the boot block, hold RP# at Vyp. 

. RP# must be at GND +0.2V to meet the 1.2 »A maximum deep power-down current. 

0. The device ID codes are identical to those of the 28F400BX 5V version. 
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4.2 28F004BX-L Bus Operations 
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Table 3. Bus Operations 


Write 


NOTES: 
1. Refer to DC Characteristics. 


. X can be Vi, or Viy for control pins and addresses, Vpp, or Vppy for Vpp. 


. See DC Characteristics for Vpp,_, VppH, VHH, Vip voltages. 


. Manufacturer and Device codes may also be accessed via a CUI write sequence. A;—Ag, Ayo-Aig = ViL. 
. Device ID = 78H for 28FO04BX-TL and 79H for 28FO04BX-BL. 


. Command writes for Block erase or byte program are only executed when Vpp = Vppy. 


. Program or erase the Boot block by holding RP# at Vp. 


2 
3 
4 
5 
6. Refer to Table 4 for valid Djjy during a write operation. 
7 
8 
9 
1 


. RP# must be at GND +0.2V to meet the 1.2 »A maximum deep power-down current. 
0. The device ID codes are identical to those of the 28F004BX 5V version. 


4.3 Read Operations 


The 4-Mbit flash family has three user read modes; 
Array, Intelligent Identifier, and Status Register. 
Status Register read mode will be discussed in detail 
in the ‘Write Operations” section. 


During power-up conditions (Vcc supply ramping), it 
takes a maximum of 700 ns from Vcc at 3.0V mini- 
mum to obtain valid data on the outputs. 


4.3.1 READ ARRAY 


If the memory is not in the Read Array mode, it is 
necessary to write the appropriate read mode com- 
mand to the CUI. The 4-Mbit flash family has three 
contro! functions, all of which must be logically ac- 
tive, to obtain data at the outputs. Chip-Enable CE # 
is the device selection control. Power-Down RP # is 
.the device power control. Output-Enable OE # is the 
DATA INPUT/OUTPUT (DQ[0:15] or DQ[0:7]) direc- 
tion control and when active is used to drive data 
from the selected memory onto the I/O bus. 


4.3.1.1 Output Control 
With OE # at logic-high level (Vj), the output from 


the device is disabled and data input/output pins 


(DQ[0:15] or DQ[0:7] are tri-stated. Data input is 
then controlled by WE#. 
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4.3.1.2 Input Control 


With WE# at logic-high level (Vj), input to the de- 
vice is disabled. Data Input/Output pins (DQ[0:15] 
or DQ[0:7]) are controlled by OE #. 


4.3.2 INTELLIGENT IDENTIFIERS 


28F400BX-L PRODUCTS 


The manufacturer and device codes are read via the 
CUI or by taking the AQ pin to 12V. Writing 90H to 
the CUI places the device into Intelligent Identifier 
read mode. A read of location OOO00H outputs the 
manufacturer’s identification code, OO89H, and loca- 
tion 00001H outputs the device code; 4470H for 
28F400BX-TL, 4471H for 28F4001BX-BL. When 
BYTE # is at a logic low only the lower byte of the 
above signatures is read and DQ;5/A_, is a “don’t 
care” during Intelligent Identifier mode. A read array 
command must be written to the CUI to return to the 
read array mode. 
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The manufacturer and device codes are also read 
via the CUI or by taking the A9 pin to 12V. Writing 
90H to the CUI places the device into Intelligent 
Identifier read mode. A read of location OOOO0H out- 
puts the manufacturer’s identification code, 89H, 
and location 00001H outputs the device code; 78H 
for 28F004BX-TL, 79H for 28FO004BX-BL. 


4.4 Write Operations 


Commands are written to the CUI using standard mi- 
croprocessor write timings. The CUI serves as the 
interface between the microprocessor and the inter- 
nal chip operation. The CUI can decipher Read Ar- 


ray, Read Intelligent Identifier, Read Status Register, » 


Clear Status Register, Erase and Program com- 
mands. In the event of a read command, the CUl 
simply points the read path at either the array, the 
Intelligent Identifier, or the status register depending 
on the specific read command given. For a program 
or erase cycle, the CUI informs the write state ma- 
chine that a write or erase has been requested. Dur- 
ing a program cycle, the Write State Machine will 
control the program sequences and the CUI will only 
respond to status reads. During an erase cycle, the 
CUI will respond to status reads and erase suspend. 
After the Write State Machine has completed its 
task, it will allow the CUI to respond to its full com- 
mand set. The CUI will stay in the current command 
state until the microprocessor issues another com- 
mand. ; 


The CUI will successfully initiate an erase or write 
operation only when Vpp is within its voltage range. 
Depending upon the application, the system design- 
er may choose to make the Vpp power supply 
switchable, available only when memory updates 
are desired. The system designer can also choose 
to “hard-wire” Vpp to 12V. The 4-Mbit flash memory 
family is designed to accommodate either design 
practice. It is recommended that RP # be tied to logi- 
cal Reset for data protection during unstable CPU 
reset function as described in the ‘Product Family 
Overview” section. 
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4.4.1 BOOT BLOCK WRITE OPERATIONS 


In the case of Boot Block modifications (write and 
erase), RP# is set to VyH = 12V typically, in addi- 
tion to Vpp at high voltage. 


However, if RP # is not at Vy when a program or 
erase operation of the boot block is attempted, the 
corresponding status register bit (Bit 4 for Program 
and Bit 5 for Erase, refer to Table 5 for Status Regis- 
ter Definitions) is set to indicate the failure to com- 
plete the operation. 


4.4.2 COMMAND USER INTERFACE (CUI) 


The Command User Interface (CUI) serves as the 
interface to the microprocessor. The CUI points the 
read/write path to the appropriate circuit block as 
described in the previous section. After the WSM 
has completed its task, it will set the WSM Status bit 
to a “1”, which will also allow the CUI to respond to 
its full command set. Note that after the WSM has 
returned control to the CUI, the CUI will remain in its 
current state. . 


4.4.2.1 Command Set 


Command Device Mode 
Codes 


Invalid/ Reserved 
Alternate Program Setup 
Erase Setup 

Program Setup 


Clear Status Register 

Read Status Register 
Intelligent Identifier 

Erase Suspend 

Erase Resume/Erase Confirm 
Read Array 


4.4.2.2 Command Function Descriptions 


Device operations are selected by writing specific 
commands into the CUI. Table 4 below defines the 
4-Mbit flash memory family commands. 
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Table 4. Command Definitions | 


Setup/Write , 
Erase Suspend/Erase Resume | 2 | 


Alternate Word/Byte Write ae 
NOTES: 


Setup/Write 
1. Bus operations are defined in Tables 1,2, 3. 


ree 
gare 
C3 | wie [x 
aes 
Ts | wite | Ba 
jae 


BA 
i 


X 
xX 
xX 
X 


2. |A = Identifier Address: OOH for manufacturer code, 01H for device code. 


3. SRD = Data read from Status Register. 
4. \ID = Intelligent Identifier Data. 


Following the Intelligent Identifier command, two read operations access manufacturer and device codes. 


5. BA = Address within the block being erased. 
6. WA = Address to be written. 

WD = Data to be written at location WA. 
7. Either 40H or 10H commands is valid. 


8. When writing commands to the device the upper data bus [DQg-DQ;5] = X (28F400BX-L-only) which is either Voc or 


Vss to avoid burning additional current. 


invalid/Reserved 


These are unassigned commands. It is not recom- 
mended that the customer use any command other 
than the valid commands specified above. Intel re- 
serves the right to redefine these codes for future 
functions. 


Read Array (FFH) 


This single write command points the read path at 
the array. If the host CPU performs a CE#/OE# 
controlled read immediately following a two-write se- 
quence that started the WSM, then the device will 
output status register contents. If the Read Array 
command is given after Erase Setup the device is 
reset to read the array. A two Read Array command 
sequence (FFH) is required to reset to Read Array 
after Program Setup. 


Intelligent Identifier (90H) 


After this command is executed, the CUI points the 
output path to the Intelligent Identifier circuits. Only 
Intelligent Identifier values at addresses 0 and 1 can 
be read (only address AO is used in this mode, all 
other address inputs are ignored). 
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Read Status Register (70H) 


This is one of the two commands that is executable 
while the state machine is operating. After this com- 
mand is written, a read of the device will output the 
contents of the status register, regardless of the ad- 
dress presented to the device. 


The device automatically enters this mode after pro- 
gram or erase has completed. 


Clear Status Register (50H) 


The WSM can only set the Program Status and 
Erase Status bits in the status register, it can not 
clear them. Two reasons exist for operating the 
status register in this fashion. The first is a synchro- 
nization. The WSM does not know when the host 
CPU has read the status register, therefore it would 
not know when to clear the status bits. Secondly, if 
the CPU is programming a string of bytes, it may be 
more efficient to query the status register after pro- 
gramming the string. Thus, if any errors exist while 
programming the string, the status register will re- 
turn the accumulated error status. 
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Program Setup (40H or 10H) 


This command simply sets the CUI into a state such 
that the next write will load the address and data 
registers. Either 40H or 10H can be used for Pro- 
gram Setup. Both commands are included to ac- 
commodate efforts to achieve an industry standard 
command code set. 


Program 


The second write after the program setup command, 
will latch addresses and data. Also, the CUI initiates 
the WSM to begin execution of the program algo- 
rithm. While the WSM finishes the algorithm, the de- 
vice will output Status Register contents. Note that 
the WSM cannot be suspended during program- 
ming. 


Erase Setup (20H) 


Prepares the CUI for the Erase Confirm command. 
No other action is taken. If the next command is not 
an Erase Confirm command then the CUI will set 
both the Program Status and Erase Status bits of the 
Status Register to a ‘1’, place the device into the 
Read Status Register state, and wait for another 
command. 


Erase Confirm (DOH) 


If the previous command was an Erase Setup com- 
mand, then the CUI will enable the WSM to erase, at 
the same time closing the address and data latches, 
and respond only to the Read Status Register and 
Erase Suspend commands. While the WSM is exe- 
cuting, the device will output Status Register data 
when OE # is toggled low. Status Register data can 
only be updated by toggling either OE # or CE # low. 


Erase Suspend (BOH) 


This command only has meaning while the WSM is 
executing an Erase operation, and therefore will only 
be responded to during an erase operation. After 
this command has been executed, the CUI will initi- 
ate the WSM to suspend Erase operations, and then 
return to responding to only Read Status Register or 
to the Erase Resume commands. Once the WSM 
has reached the Suspend state, it will set an output 
into the CUI which allows the CUI to respond to the 
Read Array, Read Status Register, and Erase Re- 
sume commands. In this mode, the CUI will not re- 
spond to any other commands. The WSM will also 
set the WSM Status bit to a “1”. The WSM will con- 
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tinue to run, idling in the SUSPEND state, regardless 
of the state of all input control pins, with the exclu- 
sion of RP#. RP# low will immediately shut down 
the WSM and the remainder of the chip. 


Erase Resume (DOH) 


This command will cause the CUI to clear the Sus- 
pend state and set the WSM Status bit to a ‘‘0’’, but 
only if an Erase Suspend command was previously 
issued. Erase Resume will not have any effect in all 
other conditions. 


4.4.3 STATUS REGISTER 


The 4 Mbit flash family contains a status register 
which may be read to determine when a program or 
erase operation is complete, and whether that oper- 
ation completed successfully. The status register 
may be read at any time by writing the Read Status 
command to the CUI. After writing this command, all 
subsequent Read operations output data from the 
status register until another command is written to 
the CUI. A Read Array command must be written to 
the CUI to return to the Read Array mode. 


The status register bits are output on DQ[O0:7] 
whether the device is in the byte-wide (x8) or word- 
wide (x16) mode for the 28F400BX-L. In the word- 
wide mode the upper byte, DQ[8:15] is set to OOH 
during a Read Status command. In the byte-wide 
mode, DO[8:14] is tri-stated and DQ15/A—1 retains 
the low order address function. 


It should be noted that the contents of the status 
register are latched on the falling edge of OE# or 
CE# whichever occurs last in the read cycle. This 
prevents possible bus errors which might occur if the 
contents of the status register change while reading 
the status register. CE# or OE# must be toggled 
with each subsequent status read, or the completion 
of a program or erase operation will not be evident. 


The Status Register is the interface between the mi- 
croprocessor and the Write State Machine (WSM). 
When the WSM is active, this register will indicate 
the status of the WSM, and will also hold the bits 
indicating whether or not the WSM was successful in 
performing the desired operation. The WSM sets 
status bits ‘“Three” through “Seven” and clears bits 
“Six” and “Seven”, but cannot clear status bits 
“Three” through “Five”. These bits can only be 
cleared by the controlling CPU through the use of 
the Clear Status Register command. 
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4.4.3.1 Status Register Bit Definition 


Table 5. Status Register Definitions 


= ERASE SUSPEND STATUS 
= Erase Suspended 
= Erase in Progress/Completed 


RASE STATUS 
rror in Block Erasure 
ccessful Block Erase 


E 
Er 
Su 
PROGRAM STATUS 

Error in Byte/Word Program 
Successful Byte/Word Program 
Vpp STATUS 

Vpp Low Detect; Operation Abort 
Vpp OK 


4.4.3.2 Clearing the Status Register 


Certain bits in the status register are set by the write 
state machine, and can only be reset by the system 
software. These bits can indicate various failure con- 
ditions. By allowing the system software to control 
the resetting of these bits, several operations may 
be performed (such as cumulatively programming 
several bytes or erasing multiple blocks in se- 
quence). The status register may then be read to 
determine if an error occurred during that program- 
ming or erasure series. This adds flexibility to the 
way the device may be programmed or erased. To 
clear the status register, the Clear Status Register 
command is written to the CUI. Then, any other 
command may be issued to the CUI. Note again that 
before a read cycle can be initiated, a Read com- 
mand must be written to the CUI to specify whether 
the read data is to come from the array, status regis- 
ter, or Intelligent Identifier. 
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SR.2-SR.0 = RESERVED FOR FUTURE ENHANCEMENTS 
These bits are reserved for future use and should be masked out when polling the Status Register. 


NOTES: 


Write State Machine Status bit must first be checked to 
determine byte/word program or block erase completion, 
before the Program or Erase Status bits are checked for 
SUCCESS. 


When Erase Suspend is issued, WSM halts execution 
and sets both WSMS and ESS bits to ‘1’. ESS bit re- 
mains set to 1” until an Erase Resume command is is- 
sued. 


When this bit is set to “1”. WSM has applied the maxi- 
mum number of erase pulses to the block and is still un- 
able to successfully perform an erase verify. 


When this bit is set to “1”, WSM has attempted but failed 
to Program a byte or word. 


The Vpp Status bit unlike an A/D converter, does not 
provide continuous indication of Vpp level. The WSM in- 
terrogates the Vpp level only after the byte write or block 
erase command sequences have been entered and in- 
forms the system if Vpp has not been switched on. The 
Vpp Status bit is not guaranteed to report accurate feed- 
back between Vpp, and Vppy. 


4.4.4 PROGRAM MODE 


Program is executed by a two-write sequence. The 
Program Setup command is written to the CUI fol- 
lowed by a second write which specifies the address 
and data to be programmed. The write state ma- 
chine will execute a sequence of internally timed 
events to: 


1. program the desired bits of the addressed memo- 
ry word (byte), and 


2. verify that the desired bits are sufficiently pro- 
grammed. 


Programming of the memory results in specific bits 
within a byte or word being changed to a “0”. 


lf the user attempts to program ‘‘1’’s, there will be no 


change of the memory cell content and no error oc- 
curs. 
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Similar to erasure, the status register indicates 
whether programming is complete. While the pro- 
gram sequence is executing, bit 7 of the status regis- 
ter is a “O”. The status register can be polled by 
toggling either CE# or OE# to determine when the 
program sequence is complete. Only the Read 


Status Register command is valid while program- 
ming is active. 


When programming is complete, the status bits, 
which indicate whether the program operation was 
successful, should be checked. If the programming 
operation was unsuccessful, Bit 4 of the status regis- 
ter is set to a “1” to indicate a Program Failure. If 
Bit 3 is set then Vpp was not within acceptable limits, 
and the WSM will not execute the programming se- 
quence. 


The status register should be cleared before at- 
tempting the next operation. Any CUI instruction can 
follow after programming is completed; however, it 
must be recognized that reads from the memory, 
status register, or Intelligent Identifier cannot be ac- 
complished until the CUI is given the appropriate 
command. A Read Array command must first be giv- 
en before memory contents can be read. 


Figure 12 shows a system software flowchart for de- 
vice byte programming operation. Figure 13 shows a 
similar flowchart for device word programming oper- 
ation (28F400BX-L-only). 


4.4.5 ERASE MODE 


Erasure of a single block is initiated by writing the 
Erase Setup and Erase Confirm commands to the 
CUI, along with the addresses, A[12:17] for the 
28F400BX-L or A[12:18] for the 28FO04BX-L, identi- 
fying the block to be erased. These addresses are 
latched internally when the Erase Confirm command 
is issued. Block erasure results in all bits within the 
block being set to “1”. 


The WSM will execute a sequence of internally 
timed events to: 


1. program all bits within the block 


2. verify that all bits within the block are sufficiently 
programmed 


3. erase all bits within the block and 


4. verify that all bits within the block are sufficiently 
erased 


While the erase sequence is executing, Bit 7 of the 
status register is a “O”’. 
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When the status register indicates that erasure is 
complete, the status bits, which indicate whether the 
erase operation was successful, should be checked. 
If the erasure operation was unsuccessful, Bit 5 of 
the status register is set to a “1” to indicate an 
Erase Failure. If Vpp was not within acceptable limits 
after the Erase Confirm command is issued, the 
WSM will not execute an erase sequence; instead, 
Bit 5 of the status register is set to a “1” to indicate 
an Erase Failure, and Bit 3 is set to a “1” to identify 
that Vpp supply voltage was not within acceptable 
limits. 


The status register should be cleared before at- 
tempting the next operation. Any CUI instruction can 
follow after erasure is completed; however, it must 
be recognized that reads from the memory array, 
status register, or Intelligent Identifier can not be ac- 
complished until the CUI is given the appropriate 
command. A Read Array command must first be giv- 
en before memory contents can be read. 


Figure 13 shows a system software flowchart for 
Block Erase operation. 


4.4.5.1 Suspending and Resuming Erase 


Since an erase operation typically requires 2 sec- 
onds to 5 seconds to complete, an Erase Suspend 
command is provided. This allows erase-sequence 
interruption in order to read data from another block 
of the memory. Once the erase sequence is started, 
writing the Erase Suspend command to the CUI _re- 
quests that the Write State Machine (WSM) pause 
the erase sequence at a predetermined point in the 
erase algorithm. The status register must be read to 
determine when the erase operation has been sus- 
pended. 


At this point, a Read Array command can be written 
to the CUI in order to read data from blocks other 
than that which is being suspended. The only other 
valid command at this time is the Erase Resume 
command or Read Status Register operation. 


Figure 14 shows a system software flowchart detail- 
ing the operation. 


During Erase Suspend mode, the chip can go into a 
pseudo-standby mode by taking CE# to Vjy and the 
active current is now a maximum of 6 mA. If the chip 
is enabled while in this mode by taking CE# to Vj,, 
the Erase Resume command can be issued to re- 
sume the erase operation. 
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Upon completion of reads from any block other than 
the block being erased, the Erase Resume com- 
mand must be issued. When the Erase Resume 
command is given, the WSM will continue with the 
erase sequence and complete erasing the block. As 
with the end of erase, the status register must be 
read, cleared, and the next instruction issued in or- 
der to continue. 
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Intel has designed extended cycling capability into 
its ETOX Ill flash memory technology. The 4-Mbit 
low voltage flash memory family is designed for 
10,000 program/erase cycles on each of the seven 
blocks. The combination of low electric fields, clean 
oxide processing and minimized oxide area per 
memory cell subjected to the tunneling electric field, 
results in very high cycling capability. 


4.4.66 EXTENDED CYCLING 
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wien Command Comments 
Operation 


Setup Data = 40H 
Program Address = Byte to be 
programmed 


Program Data to be programmed 
Address = Byte to be 
programmed 


Status Register Data. 
Toggle OE # or CE # to update 
Status Register 


Check SR.7 
1 = Ready, 0 = Busy 


Repeat for subsequent bytes. 


Full status check can be done after each byte or after a 
sequence of bytes. 


Write FFH after the last byte programming operation to 
reset the device to Read Array Mode. 
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Full Status Check Procedure 


Bus 


Standby Check SR.3 
1 = Vpp Low Detect 


Check SR.4 
1 = Byte Program Error 


SR.3 MUST be cleared, if set during a program attempt, 
before further attempts are allowed by the Write State 
Machine. 


YES 
Byte Program 
Successful SR.4 is only cleared by the Clear Status Register 


Command, in cases where multiple bytes are programmed 
290450-10 before full status is checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 12. Automated Byte Programming Flowchart 
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Write 40H, 
Word Address 
Write Word 
Address/Data 
Read Status 
Register 


YES 


Full Status 
Check If Desired 


Word Program 
Completed 
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Full Status Check Procedure 


' . 


Status Register Data 
Read (See Above) 


Vpp Range 
Error 
Word Program 
Error 


YES 


Word Program 
Successful 
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ant Command Comments 
Operation 


Setup Data = 40H 
Program Address = Word to be 
programmed 


Program Data to be programmed 
Address = Word to be 
programmed 


Status Register Data. 
Toggle OE # or CE # to update 
Status Register 


Check SR.7 
= Ready, 0 = Busy 


Repeat for subsequent words. 


Full status check can be done after each word or after a 
sequence of words. 


Write FFH after the last word programming operation to 
reset the device to Read Array Mode. 


as Command Comments 
Operation 


Standby Check SR.3 
1 = Vpp Low Detect 


Standby Check SR.4 
1 = Byte Program Error 


SR.3 MUST be cleared, if set during a program attempt, 
before further attempts are allowed by the Write State 
Machine. 


SR.4 is only cleared by the Clear Status Register 
Command, in cases where multiple words are programmed 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 13. Automated Word Programming Flowchart 
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Suspend Erase 
Loop 


290450-13 


Full Status Check Procedure 


YES 
Block Erase 
Successful 


Vpp Range 
Error 


Command Sequence 
Error 

Block Erase ; 
Error 
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Bus 
Operation 
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[Command | Comments 


Data = 20H 
Address = Within block to be 
erased 


Data = DOH 
Address = Within block to be 
erased 


Status Register Data. 
Toggle OE # or CE # to update 
Status Register 


Check SR.7 
1 = Ready, 0 = Busy 


Repeat for subsequent blocks. 


Full status check can be done after each block or after a 
sequence of blocks. 


Write FFH after the last block erase operation to reset the 


device to Read Array Mode. 


Bus 
Operation 


Standby 


Standby 


Standby 


Check SR.3 
= Vpp Low Detect 


Check SR.4,5 
Both 1 = Command Sequence 
Error 


Check SR.5 
1 = Block Erase Error 


SR.3 MUST be cleared, if set during an erase attempt, 
before further attempts are allowed by the Write State 


Machine. 


SR.5 is only cleared by the Clear Status Register 
Command, in cases where multiple blocks are erased 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 14. Automated Block Erase Flowchart 
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Write BOH 
Read Status 
Register 


YES 

YES 

Write FFH 
eee 

Reading? 

YES 


Erase Has 
Completed 
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aus Command Comments 
Operation 


Erase 
Suspend 


Status Register Data. 
Toggle OE # or CE# to 
update Status Register 


Standby Check SR.7 


1 = Ready 


Standby Check SR.6 


1 = Suspended 


Read Array Data = FFH 


Read array data from block 
other than that being 
erased. 


Erase Resume | Data = DOH . 


Figure 15. Erase Suspend/Resume Flowchart 


4.5 Power Consumption 


4.5.1 ACTIVE POWER 


With CE# at a logic-low level and RP# at a logic- 
high level, the device is placed in the active mode. 
The device loc current is a maximum of 22 mA at 
5 MHz. 


4.5.2 AUTOMATIC POWER SAVINGS 


Automatic Power Savings (APS) is a low power fea- 
ture during active mode of operation. The 4-Mbit 
family of products incorporate Power Reduction 
Control (PRC) circuitry which basically allows the de- 
vice to put itself into a low current state when it is 
not being accessed. After data is read from the 
memory array, PRC logic controls the device’s pow- 
er consumption by entering the APS mode where 
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typical Icc current is 0.8 mA and maximum Icc cur- 
rent is 2 mA. The device stays in this static state with 
outputs valid until a new memory location is read. 


4.5.3 STANDBY POWER 


With CE# at a logic-high level (Vij), and the CUl 
read mode, the memory is placed in standby mode 
where the maximum Icc standby current is 120 wA 
with CMOS input signals. The standby operation dis- 
ables much of the device’s circuitry and substantially 
reduces device power consumption. The outputs 
(DQ[0:15] or DQ[0:7] are placed in a high-imped- 
ance state independent of the status of the OE# 
signal. When the 4-Mbit flash family is deselected 
during erase or program functions, the devices will 
continue to perform the erase or program function 
and consume program or erase active power until 
program or erase is completed. | 
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4.5.4 RESET/DEEP POWER-DOWN 


The 4-Mbit flash family supports a typical Ico of 
0.2 pA in deep power-down mode. One of the target 
markets for these devices is in portable equipment 
where the power consumption of the machine is of 
prime importance. The 4-Mbit flash family has a 
RP # pin which places the device in the deep power- 
down mode. When RP# is at a logic-low (GND 
+0.2V), all circuits are turned off and the device typ- 
ically draws 0.2 nA of Voc current. 


During read modes, the RP# pin going low dese- 
lects the memory and places the output drivers in a 
high impedance state. Recovery from the deep pow- 
er-down state, requires a minimum of 700 ns to ac- 
cess valid data (tpyaqy). 


During erase or program modes, RP # low will abort 
either erase or program operation. The contents of 
the memory are no longer valid as the data has been 
corrupted by the RP# function. As in the read mode 
above, all internal circuitry is turned off to achieve 
the 0.2 A current level. 


RP# transitions to Vj. or turning power off to the 
device will clear the status register. 


This use of RP# during system reset is important 
with automated write/erase devices. When the sys- 
tem comes out of reset it expects to read from the 
flash memory. Automated flash memories provide 
status information when accessed during write/ 
erase modes. If a CPU reset occurs with no flash 
memory reset, proper CPU initialization would not 
occur because the flash memory would be providing 
the status information instead of array data. Intel’s 
Flash Memories allow proper CPU initialization fol- 
lowing a system reset through the use of the RP# 
input. In this application RP# is controlled by the 
same RESET # signal that resets the system CPU. 


4.6 Power-up Operation 


The 4-Mbit flash memory family is designed to offer 
protection against accidental block erasure or pro- 
gramming during power transitions. Upon power-up 
the 4-Mbit flash memory family is indifferent as to 
which power supply, Vpp or Voc, powers-up first. 
Power supply sequencing is not required. 


The 4-Mbit flash memory family ensures the CUI is 
reset to the read mode on power-up. 


In addition, on power-up the user must either drop 
CE # low or present a new address to ensure valid 
data at the outputs. 


A system designer must guard against spurious 
writes for Vcc voltages above Vixo when Vpp is 
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active. Since both WE# and CE# must be low for a 
command write, driving either signal to Vj} will inhibit 
writes to the device. The CUI architecture provides 
an added level of protection since alteration of mem- 
ory contents can only occur after successful com- 
pletion of the two-step command sequences. Finally 
the device is disabled until RP# is brought to Vip, 
regardless of the state of its control inputs. This fea- 
ture provides yet another level of memory protec- 
tion. 


4.7 Power Supply Decoupling 


Flash memory’s power switching characteristics re- 
quire careful device decoupling methods. System 
designers are interested in 3 supply current issues: 


e Standby current levels (Iccs) 
¢ Active current levels (IccrR) : 


e Transient peaks produced by falling and rising 
edges of CE#. 


Transient current magnitudes depend on the device 
outputs’ capacitive and inductive loading. Two-line 
control and proper decoupling capacitor selection 
will suppress these transient voltage peaks. Each 
flash device should have a 0.1 F ceramic capacitor 
connected between each Vcc and GND, and be- 
tween its Vpp and GND. These high frequency, low- 
inherent inductance capacitors should be placed as 
close as possible to the package leads. 


4.7.1 Vpp TRACE ON PRINTED CIRCUIT 
BOARDS 


Writing to flash memories while they reside in the 
target system, requires special consideration of the 
Vpp power supply trace by the printed circuit board 
designer. The Vpp pin supplies the flash memory 
cell’s current for programming and erasing. One 
should use similar trace widths and layout consider- 
ations given to the Vcc power supply trace. Ade- 
quate Vpp supply traces and decoupling will de- 
crease spikes and overshoots. 


4.7.2 Voc, Vpp AND RP# TRANSITIONS 


The CUl latches commands as issued by system 
software and is not altered by Vpp or CE# tran- 
sitions or WSM actions. Its state upon power-up, af- 
ter exit from deep power-down mode or after Vcc 
transitions below Vi xo (Lockout voltage), is Read 
Array mode. 


After any word/byte write or block erase operation is 
complete and even after Vpp transitions down to 
Vpp,, the CUI must be reset to Read Array mode via 
the Read Array command when accesses to the 
flash memory are desired. 
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5.0 OPERATING SPECIFICATIONS 


ABSOLUTE MAXIMUM RATINGS 


Operating Temperature 


intel. 


NOTICE: This data sheet contains preliminary infor- 
mation on new products in production. The specifica- 
tions are subject to change without notice. Verify with 
your local Intel Sales office that you have the latest 
data sheet before finalizing a design. 


*WARNING: Stressing the device beyond the “Absolute 


Dubin Read sa5s oan ccd poe OS 0°C to + 70°C(1) nha: 

. Maximum Ratings” may cause permanent damage. 
During Block Erase/Byte Write ....0°C to + 70°C These are stress ratings only. Operation beyond the 

Temperature Under Bias......... —10°C to 80°C “Operating Conditions” is not recommended and ex- 

Storage Temperature .......... ~65°C to + 125°C tended exposure beyond the “Operating Conditions” 


may affect device reliability. 
Voltage on any Pin 


(except Vcc, Vpp, Ag and RP #) 


with Respect toGND........ —2.0V to +7.0V(2) 
Voltage on Pin RP# or Pin Ag 
with Respect toGND ..... —2.0V to + 13.5V(2, 3) 


Voc Program Voltage with 
Respect to GND 
during Block Erase and 


Word/Byte Write ......... —2.0V to + 14.0V6(2, 3) 
Voc Supply Voltage 

with Respect toGND........ —2.0V to +7.0V(2) 
Output Short Circuit Current............. 100 mA(4) 
NOTES: 


1. Operating temperature is for commercial product defined by this specification. 

2. Minimum DC voltage is —0.5V on input/output pins. During transitions, this level may undershoot to —2.0V for periods 
<20 ns. Maximum DC voltage on input/output pins is Vcc + 0.5V which during transitions may overshoot to Voc + 2.0V 
~ for periods < 20 ns. 

3. Maximum DC voltage on Vpp may overshoot to + 14.0V for periods <20 ns. Maximum DC voltage on RP# or Ag may 
overshoot to 13.5V for periods < 20 ns. 

4. Output shorted for no more than one second. No more than one output shorted at a time. 

5. AC specifications are valid at both voltage ranges. See DC Characteristics tables for voltage range-specific specifications. 


OPERATING CONDITIONS 


Notes 
Voc 


Test Conditions 


Voc Max 


vA | Voc = 
Vin = Voc or GND 


Vcc = Voc Max 
CE# = RP# = Vip 


CE# = RP# = Vcc +0.2V 
28F400Bx: 
BYTE# = Voc +0.2V or GND 
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D.C. CHARACTERISTICS Vcc = 3.3V +0.3V (Continued) 


Preset ramet —_—_ ete, ye,_Mex_lun Test Conditions 
Icco Voc Deep Power-Down Current Pe ba RP# = GND +0.2V 


IccrR |Vcc Read Current for mA |Vcc = Vcc Max, CE# = GND 
28F400BX-L Word-Wide and f = 5 MHz, lout = OmA 
Byte-Wide Mode and CMOS Inputs 

mA Vcc = Vcc Max, CE# = Vi. 
f = 5 MHz, lout = OMA 
TTL Inputs 


icon Nec Wordwite Curent | 1 | | | 90 |malword witein Progress 
me 
coe Noo Book Erase Gurent [1 | [| 20 [mA Block Erase in Progress 


ICcES eee Erase ee ee Ure Current 1,2 mA |Block Erase Suspended, 
pre = a ae 


iets [ttf ae fpr oar — 
Sm a 


ppw_ |Vpp Word Write Current MA |Vpp = VppyH 
Word Write in Progress 
ppw_ _|Vpp Byte Write Current mA |Vpp = VppyH 
Byte Write in Progress 
Vpp Block Erase Current 1 mA |Vpp = VppH 
Block Erase in Progress 
Vpp Erase Suspend Current 1 A |Vpp = VppH 
Block Erase Suspended 


RP# Boot Block Unock Curent | 1.4 | 
ence ge Ty 
he Intetigent denier Votage |_| 
1 rowttow vonage 
iputrighvolags 


28F004BX-L Byte-Wide Mode 


=< 


< 


oL _|Output Low Voltage 


Von. Nep dung Normal Operations | 9 ci ES 
1 Now during Ereoe/Wite Operations! | rra]raol ee [v[ 
Wino NecErase/weoteckvotage | f2of | [v[ 
FPe Unk atage |‘ naliaol 180 v [Bostock wees 


< 
O 
r 
© 
os 
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= 
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CAPACITANCE(4) T, = 25°C, f = 1 MHz : 


(ewan 
[putGepactarco |e | 8 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Voc = 3.3V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (packages and speeds). 

2. IccEs is specified with the device deselected. If the device is read while in Erase Suspend Mode, current draw is the sum 
of Icces and Iccr. 

3. Block Erase and Word/Byte Writes are inhibited when Vpp = Vpp, and not guaranteed in the range between Vppy, and 
VPPL- 

4. Sampled, not 100% tested. 

5. Automatic Power Savings (APS) reduces Iccr to less than 2 mA in static operation. 

6. CMOS Inputs are either Voc +0.2V or GND +0.2V. TTL Inputs are either Vi, or Vip. 
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D. ae CHARACTERISTICS(4) Voc = 5.0V +10% 


/__Parnetr_—__[nots| wn [op [nt Tat canons] 


Srmbelt _ Load Current +1.0} wA | Voc = Voc Max 
Vin = Voc or GND 
Output Leakage Current +10 ba Voc = Vcc Max 
aie = Vcc or GND 


locs Voc Standby Current Gok Voc = Voc Max 
oe = RP# = Vip 
os BMA | Voc = Voc Max 
: CE# = RP# = Vcc +0.2V 
Iccb Vcc Deep Power-Down Current 12 RP# = GND +0.2V 
louT = OmA 


IocR Voc Read Current for mA | Vcc = Vcc Max, CE# = GND 
28F400BX-L Word-Wide Mode f = 5 MHz, lout = OMA 


CMOS Inputs 


Voc = Vcc Max, CE# = Vi, 
f = 5 MHz, lout = OMA 
TTL Inputs 


Voc Read Current for 1 Voc = Vcc Max, CE# = GND 
28F400BX-L Byte-Wide Mode f = 5 MHz, lout = OMA 
and 28F004BX-L CMOS Inputs 


Voc = Vcc Max, CE# = Vi, 
f = 5 MHz, loyt = OMA 
TTL Inputs 


Iccw Voc Word Byte Write Current tL Word Write in Paty pg ee 
ICCE Voc Block Erase Current | 30 | mA | Block Erase in |Block Erase in Progress 


IcceEs | Vcc Erase Suspend Current ie pea Block Erase Suspended, 
CE# = tna ine sei 


Mee eT 
eT ee ee 


Ippw Vpp Word Write Current 1 40 | mA | Vpp = VppyH 
Word Write in Progress 
IPpw Vpp Byte Write Current Vpp = VppyH 
Byte Write in Progress 
Vpp Block Erase Current 1 mA | Vpp = VppyH ; 
Block Erase in Progress 
Vpp Erase Suspend Current 1 a Vpp = VppH 
Block Erase Suspended 
RP # Boot Block 1,4 
Unlock Current 
Ag Intelligent | 1,4 
Identifier Current 
Ag Intelligent 11.4) 12.0} 13.0] V 
Identifier Voltage 
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A 
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D.C. CHARACTERISTICS(4) Vcc = 5.0V +10% (Continued) | 


Output Low Voltage 0.45 V_ |Voc = Vcc Min 
lo. = 5.8mA - 


Symbol 

Has 

an 

Pas 

lon = —2.5mA 

i mii sake 

= 

ei! 

cae 


Nh 
aS 


Vpp during Normal Operations 
Vpp during Erase/Write Operations 11.4 | 12.0 1 
Voc Erase/Write Lock Voltage 
RP # Unlock Voltage 

NOTES: 


1. All currents are in RMS unless otherwise noted. Typical values at Voc = 5.0V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (packages and speeds). : 

2. Icces is specified with the device deselected. If the device is read while in Erase Suspend Mode, current draw is the sum 
of Icces and Iccr. 

3. Block Erases and Word/Byte Writes are inhibited when Vpp = Vpp, and not guaranteed in the range between Vppy and 
VPPL: 

4. All parameters are sampled, not 100% tested. 


rk eee eee 


A.C. INPUT/OUTPUT REFERENCE WAVEFORM A.C. TESTING LOAD CIRCUIT 


eu sa ra = our 
INPUT 1.5 <— TEST POINTS ——> 3% 1.5 OUTPUT 
0.0 DEVICE 


290450-16 UNDER 
AC test inputs are driven at 3.0V for a Logic ‘1’ and 0.0 for a Logic “0”. TEST 
Input timing begins, and output timing ends at 1.5V. Input rise and fall times 
(10% to 90%) < 3ns. 
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C. = 50 pF 
C. Includes Jig Capacitance 
R, = 3.3 Ka 
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A.C. CHARACTERISTICS-Read-Only Operations(1) Voc = 3.3V +0.3V, 5.0V +10% 


28F004BX-L150 
| Symbol Parameter _Notes | Min 
tavav | to | ReadCycleTime | 
jtavav | taco | Addressto OutputDelay | 
tray | toe | Ce#toOutputDelay | 
tenav | tpwu | RP# High toOutputDelay | || 800s 
ar 
: cea 


= 
Teuay | tor | O&# eOuptbey 


: ee 
toH Output Hold from Addresses, CE # or OE # 
Change, Whichever is First 
tELEL CE # to BYTE # Switching 
tELFH Low or High 
tEHOV BYTE # Switching High 3,4 
to Valid Output Delay | 
tFLQz BYTE # Switching Low 45 
to Output High Z 
NOTES: 
1. See AC Input/Output Reference Waveform for timing measurements. 
2. OE# may be delayed up to tce-tog after the falling edge of CE# without impact on tce. 
3. Sampled, not 100% tested. 


4. teLqv, BYTE#. switching low to valid output delay will be equal to tayqy, measured from the time DQ ;5/A.4 becomes 
valid. 
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Vin 
CE# (E) 


Vit 


Vin 


OE# (GC) 
Vit 


Vin 
WE# (W) 


Vit 


Vin 


DATA (D/Q) 
Vi 


RP# (P) 


Voc POWER-UP 


== XXXKKYY 


HIGH Z 


DEVICE AND 
ADDRESS SELECTION 


OUTPUTS ENABLED 


ADDRESSES STABLE 


teLav 
teLax 
teLox 


Ria tavav 


tpHaV 


tcLov 


Kq 


VALID OUTPUT 


tou 


STANDBY Voc POWER-DOWN 


WAKA 
Ra KX 
teHoz 


tcHaz 


row HIGH Z 
LLLLY 
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mee XXKKKKK 4 ADDRESSES STABLE RAKANKA 


tavav 


Vin 


ViL 
taver = teLeL — 


Vin 


OE# (G) 


ViL 


Vin 


BYTE# (F) 


HIGH Z 


N 
DATA \ 
OUTPUT AWN HIGH Z 


4 / 
Cre >>. 


DATA (DQ) -DQ, ) 


Vi 


tavav 
Loz 
y 
DATA 
HIGH Z 
DATA (DQg -DQ, 4 ) K« “ieee } 
al 
\ 
tavav 
I, 
DATA 
DQ5 /A_, 4 OUTPUT yi z 4 ADDRESS HIGH Z 
h ON 00, 5 INPUT 
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Figure 17. BYTE # Timing Diagram for Both Read and Write Operations for 28F400BX-L 
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A.C. CHARACTERISTICS For WE-Controlled Write Operations(1) Voc = 3.3V +0.3V, 5.0V +10% 


Versions(4) 28F400BX-L150 
28F004BX-L150 
- Parameter 


Write Cycle Time 


tPHWL RP # High Recovery 
to WE # Going Low 
tELWL tcs CE # Setup to WE# 
Going Low 
RP# Vin Setup to WE # 
Going High 


— 
f 

< 
> 
< 

+ 
= 
@) 


Vpp Setup to WE # Going High 


tavWH tas Address Setup to WE # 
Going High 


tpVvWH Data Setup to WE # Going High 


twe | WE# Pulse Width 


tWwHDx Data Hold from WE # High 
WE # High 
Address Hold from WE # High 


CE # Hold from WE # High 


WE # Pulse Width High 
tWHQV1 Duration of Word/Byte 
Programming Operation 
twHaVv2 Duration of Erase 
Operation (Boot) 
twHov3 Duration of Erase 
Operation (Parameter) 
ce ee Duration of Erase 


Operation (Main) 


Vpp Hold from Valid SRD 


RP# Viuy Hold from Valid SRD 
Boot-Block Relock Delay 


> 
= 
ck 
m 
ym 

-- 

e 

x 


NOTES: 

1. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
Characteristics during Read Mode. 

2. The on-chip WSM completely automates program/erase operations; program/erase algorithms are now controlled inter- 
nally which includes verify and margining operations. 

3. Refer to command definition table for valid Ajy. 

4. Refer to command definition table for valid Diy. 

5. Program/Erase durations are measured to valid SRD data (successful operation, SR.7 = 1). 

6. For Boot Block Program/Erase, PWD# should be held at Vy} until operation completes successfully. 

7. Time tpypr, is required for successful relocking of the Boot Block. 

8. Sampled but not 100% tested. 
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BLOCK ERASE AND BYTE/WORD WRITE PERFORMANCE Vcc = 3.3V +0.3V, 5.0V +10% 


28F400BX-L150 
Parameter 28F004BX-L150 


Boot/Parameter Block Erase Time 


Main Block Erase Time 
Main Block Byte Program Time 
Main Blok Word Program Time 


NOTES: 
1. 25°C, 12.0V Vpp. 
2. Excludes System-Level Overhead. 
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Voc POWER-UP 
& STANDBY ERASE SETUP COMMAND 


VV x) OOOO VV XX x) \/ KKK KKK V/ ). {X XX KX X XX x) 
1, aD GSI 50) sen unuonoonoonon rocoto 


Vin 
ADDRESSES (A) 
Vit 


Vi 


Vit 


WRITE 
VALID ADDRESS & DATA (PROGRAM) 
OR ERASE CONFIRM COMMAND 


READ STATUS WRITE READ ARRAY 
REGISTER DATA COMMAND 


AUTOMATED PROGRAM 
OR ERASE DELAY 


WRITE PROGRAM OR 


tavay tavWH tWwHAX 


teLWL tWHEH i 


twHav1,2,3,4 


wpe 
tovwH ra 
HIGH 2 [TR vaio \\\ 
= { » ( \\ EE // Co) 
teHHWH tovPH 
tavvL 
OXXKKKKKKKKKRRR RY) RXKXK KKK KRRN ERK 
AXXXY : NXAKXKRXARX ARK 


(XYXKKKK KKK KKKKKK YY XXX XXX \/ XX rer XX XKKKX 
BY XXX XXX 
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A.C. CHARACTERISTICS FOR CE #-CONTROLLED WRITE OPERATIONS 
Voc = 3.3V +0.3V, 5.0V +10% 


28F004BX-L150 
Parameter Notes 
CE # Going Low 
DH 
AH 


1 


= 
7) 


” 


= [on 
oOo1o 


10 
100 


tas i 

! tpven | tos Data Setup to CE # Going High 
CE# Pulse Width High 
evan} J Duration of Programming 

Operation Word/Byte 
tenave |_| Duration of Erase Operation (Boot) 
eae | | Duration of Erase 

Operation (Parameter) 
!teHova |_| Duration of Erase Operation (Main) 


RP# Vin Hold from Valid SRD 
/tpypr | | Boot-Block Relock Delay 7,8 


NOTES: } 

1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of CE# and WE# in systems where 
CE# defines the write pulse-width (within a longer WE# timing waveform), all set-up, hold and inactive WE# times should 
be measured relative to the CE # waveform. 

2, 3, 4, 5, 6, 7, 8. Refer to A.C. Characteristics for WE #-Controlled Write operations. 

9. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
Characteristics during Read Mode. 


ae 


1 
1 
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Voc POWER-UP 


Vin 
ADDRESSES (A) 
Vit 


Vin 
OE# (G) 
Vit 


Vin 
CE# (E) 
Vit 


Vin 
DATA (D/Q) 
Vi 


WRITE 


WRITE PROGRAM OR VALID ADDRESS & DATA (PROGRAM) AUTOMATED PROGRAM READ STATUS WRITE READ ARRAY 


& STANDBY ERASE SETUP COMMAND OR ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER DATA COMMAND 
ee (YK KK KKK XXX) es XKXKKKKKK KA (XX VY XX XX XX "é 
i ED GRE Co nicuiuiciuunuuonmnonooonnes 
taVAV tAVEH tEHAX 
tWLEL teHWH 


a ‘eHav1,2,3,4 
ae 


oy | ALy vauo \\\ 
WX 5 SL/ 


toHHEH tovPH 
| ‘ 
’ } ‘ 


Yavve 
V/V/ XXKKKXK re" VY XX x KXXXKXK KKK KX \/ KOK KX 
LX RRR KKK RXY RRR RADY 
(KN XKKKKKKKK KK XX xy OXXXKK XK KKK XXXX VAVAV, 
BOY KKK KXKKKKXXY 
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ORDERING INFORMATION 


BBoq0000oe008o 
T. st ACCESS SPEED (ns) 


PACKAGE 150 ns 
E = STANDARD 56 LEAD TSOP 


PA = 44 LEAD PSOP 290450-21 


VALID COMBINATIONS: 
E28F400BX-L150 PA28F400BX-L150 


BBOGooOonoeooeo 
> ie ACCESS SPEED (ns) 


PACKAGE 


E = STANDARD 40 LEAD TSOP 150 ns 
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VALID COMBINATIONS: 
E28F004BX-L150 


ADDITIONAL INFORMATION Order Number 
28F200BX/28F002BX Data Sheet 290448 
28F200BXL/28F002BXL Data Sheet 290449 
28F400BX/28F004BxX Data Sheet 290451 
AP-363 ‘Extended Flash BIOS Design for Portable Computers” 292098 
AP-357 “Power Supply Solutions for Flash Memory ; 292092 
ER-28 “ETOX-IIl Flash Memory Technology” 294012 
ER-29 “The Intel 2/4-Mbit Boot Block Flash Memory Family” 294013 


REVISION HISTORY 


Cnr Oe a 
Original Version 


Modified BYTE # Timing Waveforms 
Modified toywyH parameter for AC Characteristics for Write Operations 
PWD renamed to RP # for JEDEC standarization compatibility. | 


Combined Vcc Read Current for 28F400BX-L Word-Wide and Byte-Wide Mode 
and 28F004BX-L Byte Wide Mode in DC Characteristics tables. 


Changed Ipps current spec from +10 wA to +15 pA in DC Characteristics table. 
Added Boot Block Unlock current spec in DC Characteristics tables. 
Improved tpwu spec to 600 ns (was 700 ns). 


Changed Iccr maximum spec from 20 mA to 25 mA, and added 15 mA typical spec 
in DC Characteristics Table. 
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2-MBIT (128K x 16, 256K x 8) BOOT BLOCK 
FLASH MEMORY FAMILY 


m x8/x16 Input/Output Architecture 
— 28F200BX-T, 28F200BX-B 
— For High Performance and High 
Integration 16-bit and 32-bit CPUs 


m@ x8-only Input/Output Architecture 
— 28F002BX-T 28F002BX-B 
— For Space Constrained 8-bit 
Applications 


m Optimized High Density Blocked 
Architecture 
— One 16-KB Protected Boot Block 
— Two 8-KB Parameter Blocks 
— One 96-KB Main Block 
— One 128 KB Main Block 
— Top or Bottom Boot Locations 


m Extended Cycling Capability 
— 100,000 Block Erase Cycles 


= Automated Word/Byte Write and 
Block Erase 
— Command User Interface 
— Status Registers 
— Erase Suspend Capability 


= SRAM-Compatible Write Interface 


m@ Automatic Power Savings Feature 
-—1mA Typical Icc Active Current in 
Static Operation 


m@ Hardware Data Protection Feature 
— Erase/Write Lockout during Power 
Transitions 
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Very High-Performance Read 

— 60/80 ns Maximum Access Time 

— 30/40 ns Maximum Output Enable 
Time 

Low Power Consumption 

— 20 mA Typical x8 Active Read 
Current 

— 25 mA Typical x16 Active Read 
Current 


Reset/Deep Power-Down Input 
— 0.2 »A icc Typical 
— Acts as Reset for Boot Operations 


Extended Temperature Operation 
— — 40°C to + 85°C 


Write Protection for Boot Block 


industry Standard Surface Mount 
Packaging 
— 28F200BX: JEDEC ROM Compatible 
44-Lead PSOP 
56-Lead TSOP 
— 28F002BX: 40-Lead TSOP 


12V Word/Byte Write and Block Erase 
—Vpp = 12V +5% Standard 
—Vpp = 12V + 10% Option 


ETOX lil Flash Technology 
— 5V Read . 


independent Software Vendor Support 


October 1993 
Order Number: 290448-003 
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Intel’s 2-Mbit Flash Memory Family is an extension of the Boot Block Architecture which includes block-selec- 
tive erasure, automated write and erase operations and standard microprocessor interface. The 2-Mbit Flash 
Memory Family enhances the Boot Block Architecture by adding more density and blocks, x8/x16 input/out- 
put control, very high speed, low power, an industry standard ROM compatible pinout and surface mount 
packaging. The 2-Mbit flash family allows for an easy upgrade to Intel’s 4-Mbit Boot Block Flash Memory 
Family. 


The Intel 28F200BX-T/B are 16-bit wide flash memory offerings. These high density flash memories provide 
user selectable bus operation for either 8-bit or 16-bit applications. The 28F200BX-T and 28F200BX-B are 
2,097,152-bit non-volatile memories organized as either 262,144 bytes or 131,072 words of information. They 
are offered in 44-Lead plastic SOP and 56- Lead TSOP packages. The x8/x16 pinout conforms to the industry 
standard ROM/EPROM pinout. 


The Intel 28F002BX-T/B are 8-bit wide flash memories with 2,097,152 bits organized as 262,144 bytes of 
information. They are offered in a 40-Lead TSOP package, which is ideal for space-constrained portable 
systems. 


These devices use an integrated Command User Interface (CUI) and Write State Machine (WSM) for simplified 
word/byte write and block erasure. The 28F200BX-T/28F002BX-T provide block locations compatible with 
Intel’s MCS-186 family, 80286, i386™, i486™, i860™ and 80960CA microprocessors. The 28F200BX-B/ 
28F002BX-B provide compatibility with Intel’s BO960KX and 80960SX families as well as other embedded 
microprocessors. 


The boot block includes a data protection feature to protect the boot code in critical applications. With a 
maximum access time of 60 ns, these 2-Mbit flash devices are very high performance memories which 
interface at zero-wait-state to a wide range of microprocessors and microcontrollers. A deep power-down 
mode lowers the total Vcc power consumption to 1 »W typical. This is critical in handheld battery powered 
systems. For very low power applications using a 3.3V supply, refer to the Intel 28F200BX-TL/BL, 28F002BX- 
TL/BL 2-Mbit Boot Block Flash Memory Family datasheet. 


Manufactured on Intel’s 0.8 micron ETOXIIl process, the 2-Mbit flash memory family provides world class 
quality, reliability and cost-effectiveness at the 2-Mbit density level. 
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1.0 PRODUCT FAMILY OVERVIEW 


Throughout this datasheet the 28F200BX refers to 
both the 28F200BX-T and 28F200BX-B devices and 
28F002BX refers to both the 28FO02BX-T and 
28F002BX-B devices. The 2-Mbit flash memory fam- 
ily refers to both the 28F200BX and 28F002BxX prod- 
ucts. This datasheet comprises the specifications for 
four separate products in the 2-Mbit flash memory 
family. Section 1 provides an overview of the 2-Mbit 
flash memory family including applications, pinouts 
and pin descriptions. Sections 2 and 3 describe in 
detail the specific memory organizations for the 
28F200BX and 28F002BX products respectively. 
Section 4 combines a description of the family’s 
principles of operations. Finally Section 5 describes 
the family’s operating specifications. 


PRODUCT FAMILY 


x8/x16 Products x8-Only Products 
28F200BX-T 28F002BX-T 
28F200BX-B 28F002BX-B 


1.1 Main Features 


The 28F200BX/28F002BxX boot block flash memory 
family is a very high performance 2-Mbit (2,097,152 
bit) memory family organized as either 128 KWords 
(131,072 words) of 16 bits each or 256 Kbytes 
(262,144 bytes) of 8 bits each. 


Five Separately Erasable Blocks including a hard- 
ware-lockable boot block (16,384 Bytes), two pa- 
rameter blocks (8,192 Bytes each) and two main 
blocks (1 block of 98,304 Bytes and 1 block of 
131,072 Bytes) are included on the 2-Mbit family. An 
erase operation erases one of the main blocks in 
typically 2.4 seconds, and the boot or parameter 
blocks in typically 1.0 second. Each block can be 
independently erased and. programmed 100,000 
times. 


The Boot Block is located at either the top 
(28F200BX-T, 28F002BX-T) or the bottom 
(28F200BX-B, 28F002BX-B) of the address map in 
order to accommodate different microprocessor pro- 
tocols for boot code location. The hardware locka- 
ble boot block provides the most secure code stor- 
age. The boot block is intended to store the kernel 
code required for booting-up a system. When the 
RP # pin is between 11.4V and 12.6V the boot block 
is unlocked and program and erase operations can 
be performed. When the RP # pin is at or below 6.5V 
the boot block is locked and program and erase op- 
erations to the boot block are ignored. 
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The 28F200BX products are available in the ROM/ 
EPROM compatible pinout and housed in the 44- 
Lead PSOP (Plastic Small Outline) package and the 
56-Lead TSOP (Thin Small Outline, 1.2mm _ thick) 
package as shown in Figures 3 and 4. The 
28F002BX products are available in the 40-Lead 
TSOP (1.2mm thick) package as shown in Figure 5. 


The Command User Interface (CUI) serves as the 
interface between the microprocessor or microcon- 
troller and the internal operation of the 28F200BX 
and 28F002BX flash memory products. 


Program and Erase Automation allows program 
and erase operations to be executed using a two- 
write command sequence to the CUI. The internal 
Write State Machine (WSM) automatically executes 
the algorithms and timings necessary for program 
and erase operations, including verifications, there- 
by unburdening the microprocessor or microcontrol- 
ler. Writing of memory data is performed in word or 
byte increments for the 28F200BX family and in byte 
increments for the 28F002BX family typically within 
9 ps which is a 100% improvement over current 
flash memory products. 


The Status Register (SR) indicates the status of the 
WSM and whether the WSM successfully completed 
the desired program or erase operation. 


Maximum Access Time of 60 ns (TACC) is achieved 
over the commercial temperature range (0°C to 
70°C), 5% Vcc supply voltage range (4.75V to 
5.25V) and 30 pF output load. Refer to Figure 19; 
Tacc vs Output Load Capacitance for larger output 
loads. Maximum Access Time of 80 ns (TACC) is 
achieved over the commercial temperature range, 
10% Vcc supply range (4.5V to 5.5V) and 100 pF 
output load. 


Ipp maximum Program current is 40 mA for x16 
operation and 30 mA for x8 operation. Ipp Erase 
current is 30 mA maximum. Vpp erase and pro- 
gramming voltage is 11.4V to 12.6V (Vpp = 12V 
+5%) under all operating conditions. As an op- 
tion, Vpp can also vary between 10.8V to 13.2V (Vpp 
= 12V +10%) with a guaranteed number of 100 
block erase cycles. 


Typical I¢c Active Current of 25 mA is achieved 
for the x16 products (28F200BX), typical Icc Active 
Current of 20 mA is achieved for the x8 products 
(28F200BX, 28F002BX). Refer to the Icc active cur- 


_ rent derating curves in this datasheet. 


The 2-Mbit boot block flash family is also designed 
with an Automatic Power Savings (APS) feature to 
minimize system battery current drain and allow for 
very low power designs. Once the device is ac- 
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cessed to read array data, APS mode will immedi- 
ately put the memory in static mode of operation 


where Icc active current is typically 1 mA until the 
next read is initiated. 


When the CE# and RP# pins are at Vcc and the 
BYTE# pin (28F200BxX-only) is at either Voc or 
GND the CMOS Standby mode is enabled where 
Icc is typically 50 pA. 


A Deep Power-Down Mode is enabled when the 
RP # pin is at ground minimizing power consumption 
and providing write protection during power-up con- 
ditions. I¢¢ current during deep power-down mode 
is 0.20 A typical. An initial maximum access time 
or Reset Time of 300 ns is required from RP# 
switching until outputs are valid. Equivalently, the 
device has a maximum wake-up time of 215 ns until 
writes to the Command User Interface are recog- 
nized. When RP # is at ground the WSM is reset, the 
Status Register is cleared and the entire device is 
protected from being written to. This feature pre- 
vents data corruption and protects the code stored 
in the device during system reset. The system Reset 
pin can be tied to RP# to reset the memory to nor- 
mal read mode upon activation of the Reset pin. 
With on-chip program/erase automation in the 
2-Mbit family and the RP # functionality for data pro- 
tection, when the CPU is reset and even if a program 
or erase command is issued, the device will not rec- 
ognize any operation until RP# returns to its normal 
state. 


For the 28F200BX, Byte-wide or Word-wide In- 
put/Output Control is possible by controlling the 
BYTE# pin. When the BYTE# pin is at a logic low 
the device is in the byte-wide mode (x8) and data is 
read and written through DQ[0:7]. During the byte- 
wide mode, DQ[8:14] are tri-stated and DQ15/A—1 
becomes the lowest order address pin. When the 
BYTE# pin is at a logic high the device is in the 
word-wide mode (x16) and data is read and written 
through DQ[0:15]. 


1.2 Applications 


The 2-Mbit boot block flash family combines high 
density, high performance, cost-effective flash mem- 
ories with blocking and hardware protection capabili- 
ties. Its flexibility and versatility will reduce costs 
throughout the product life cycle. Flash memory is 
ideal for Just-In-Time production flow, reducing sys- 
tem inventory and costs, and eliminating component 
handling during the production phase. During the 
product life cycle, when code updates or feature en- 
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hancements become necessary, flash memory will 
reduce the update costs by allowing either a user- - 
performed code change via floppy disk or a remote 
code change via a serial link. The 2-Mbit boot block 
flash family provides full function, blocked flash 


_ memories suitable for a wide range of applications. 


These applications include Extended PC BIOS, 
Digital Cellular Phone program and data storage, 
Telecommunication boot/firmware, and various 
other embedded applications where both program 
and data storage are required. 


Reprogrammable systems such as personal com- 
puters, are ideal applications for the 2-Mbit flash 
products. Portable and handheld personal computer 
applications are becoming more complex with the 
addition of power management software to take ad- 
vantage of the latest microprocessor technology, 
the availability of ROM-based application software, - 
pen tablet code for electronic hand writing, and diag- 
nostic code. Figure 1 shows an example of a 
28F200BX-T application. 


This increase in software sophistication augments 
the probability that a code update will be required 
after the PC is shipped. The 2-Mbit flash products 
provide an inexpensive update solution for the note- 
book and handheld personal computers while ex- 
tending their product lifetime. Furthermore, the 
2-Mbit flash products’ power-down mode provides 
added flexibility for these battery-operated portable 
designs which require operation at very low power 
levels. 


The 2-Mbit flash products also provide excellent de- 
sign solutions for Digital Cellular Phone and Tele- 
communication switching applications requiring high 
performance, high density storage capability cou- 
pled with modular software designs, and a smail 
form factor package (x8-only bus). The 2-Mbit’s 
blocking scheme allows for an easy segmentation of 
the embedded code with; 16 Kbytes of Hardware- 
Protected Boot code, 2 Main Blocks of program 
code and 2 Parameter Blocks of 8 Kbytes each for 
frequently updatable data storage and diagnostic 
messages (e.g. phone numbers, authorization 
codes). Figure 2 is an example of such an applica- 
tion with the 28FO02BX-T. 


These are a few actual examples of the wide range 
of applications for the 2-Mbit Boot Block flash mem- 
ory family which enable system designers to achieve 
the best possible product design. Only your imagina- 
tion limits the applicability of such a versatile product 
family. 
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Figure 2. 28F002BX Interface to INTEL 80C 188EB 8-Bit Embedded Microprocessor 
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j The 28F002BX 40-Lead TSOP pinout shown in Fig- 
13 Pinouts ure 5 is 100% compatible and provides a density 
The 28F200BX 44-Lead PSOP pinout follows the in- upgrade to the 28F004BX 4-Mbit Boot Block flash 
dustry standard ROM/EPROM pinout as shown in memory. 7 
Figure 3 with an upgrade to the 28F400BX (4-Mbit 
flash family). Furthermore, the 28F200BX 56-Lead 
TSOP pinout shown in Figure 4 provides density up- 
grades to the 28F400BX and to future higher density 
boot block memories. 


28F400BX 28F400BX 


PA28F200BX 
44 LEAD PSOP 


0.525” x 1.110” % chee 
TOP VIEW 3171 09,5 /A,, 


290448-25 


Figure 3. PSOP Lead Configuration for x8/x16 28F200BX 
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28F002BX 
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Figure 5. TSOP Lead Configuration for x8 28FO02BX 
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1.4 Pin Descriptions for the x8/x16 28F200BX 


| Symbol | Type Name and Function 


Ao-Aié6 ADDRESS INPUTS for memory addresses. Addresses are internally latched 
during a write cycle. 
Ag 


ADDRESS INPUT: When Ag is at 12V the signature mode is accessed. During this 
mode Ap decodes between the manufacturer and device ID’s. When BYTE # is at 
a logic low only the lower byte of the signatures are read. DQ;5/A_, is adon’t 

care in the signature mode when BYTE # is low. 


DATA INPUTS/OUTPUTS: Inputs array data on the second CE # and WE # cycle 
during a program command. Inputs commands to the Command User Interface 
when CE # and WE # are active. Data is internally latched during the write and 
program cycles. Outputs array, Intelligent Identifier and Status Register data. The 
data pins float to tri-state when the chip is deselected or the outputs are disabled. 


DATA INPUTS/OUTPUTS: Inputs array data on the second CE # and WE# cycle 
during a program command. Data is internally latched during the write and program 
cycles. Outputs array data. The data pins float to tri-state when the chip is 
deselected or the outputs are disabled as in the byte-wide mode (BYTE # = “0”’). 
In the byte-wide mode DQ ;5/A_— 4 becomes the lowest order address for data 
output on DQ9-DQ;7. 


CHIP ENABLE: Activates the device’s control logic, input buffers, decoders and 
sense amplifiers. CE # is active low; CE # high deselects the memory device and 
reduces power consumption to standby levels. If CE# and RP# are high, but not 
at a CMOS high level, the standby current will increase due to current flow through 
the CE# and RP # input stages. 


RESET/DEEP POWER-DOWN: Provides three-state control. Puts the device in 
deep power-down mode. Locks the boot block from program/erase. 


When FP # is at logic high level and equals 6.5V maximum the boot block is 
locked and cannot be programmed or erased. 


When RP# = 11.4V minimum the boot block is unlocked and can be programmed 
or erased. ! 


When FP # is at a logic low level the boot block is locked, the deep power-down 
mode is enabled and the WSM is reset preventing any blocks from being 
programmed or erased, therefore providing data protection during power 
transitions. When RP # transitions from logic low to logic high the flash memory 
enters the read array mode. 


OE# OUTPUT ENABLE: Gates the device’s outputs through the data buffers during a 
read cycle. OE # is active low. | 
WE # WRITE ENABLE: Controls writes to the Command Register and array blocks. 


WE # is active low. Addresses and data are latched on the rising edge of the WE # 


BYTE # ENABLE: Controls whether the device operates in the byte-wide mode 
(x8) or the word-wide mode (x16). BYTE # pin must be controlled at CMOS levels 
to meet 100 wA CMOS current in the standby mode. BYTE # = “0” enables the 
byte-wide mode, where data is read and programmed on DQ9-DQ7 and 
DQi5/A— 1 becomes the lowest order address that decodes between the upper 
and lower byte. DQg-—DQ 4 are tri-stated during the byte-wide mode. 
BYTE# = “1” enables the word-wide mode where data is read and programmed 
on DQo-DQ js. 
Vpp PROGRAM/ERASE POWER SUPPLY: For erasing memory array blocks or 
programming data in each block. 
Note: Vpp < Vpp; wax Memory contents cannot be altered. 


|GND__ |__| GROUND: Forallinternalcircuitry, 
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1.5 Pin Descriptions for x8 28F002BX 


Type 


ADDRESS INPUTS for memory addresses. Addresses are internally latched during 
a write cycle. 


ADDRESS INPUT: When Ag is at 12V the signature mode is accessed. During this 
mode Ap decodes between the manufacturer and device |ID’s. 


DATA INPUTS/OUTPUTS: Inputs array data on the second CE # and WE # cycle 
during a program command. Inputs commands to the command user interface 
when CE # and WE # are active. Data is internally latched during the write and | 
program cycles. Outputs array, Intelligent Identifier and status register data. The 
data pins float to tri-state when the chip is deselected or the outputs are disabled. 


CHIP ENABLE: Activates the device’s control logic, input buffers, decoders and 
sense amplifiers. CE # is active low; CE # high deselects the memory device and 

reduces power consumption to standby levels. If CE # and RP# are high, but not at 
a CMOS high level, the standby current will increase due to current flow through the 
CE # and RP # input stages. 


RESET/DEEP POWERDOWN: Provides Three-State control. Puts the device in 
deep powerdown mode. Locks the Boot Block from program/erase. 

When RP # is at logic high level and equals 6.5V maximum the Boot Block is locked 
and cannot be programmed or erased. 


When RP# = 11.4V minimum the Boot Block is unlocked and can be programmed 
or erased. 


When FP # is at a logic low level the Boot Block is locked, the deep powerdown 
mode is enabled and the WSM is reset preventing any blocks from being 
programmed or erased, therefore providing data protection during power 


ee 
transitions. When RP # transitions from logic low to logic high, the flash memory 


#RP# 
enters the read-array mode. 


Ao-A17 


ye eae 


e 


is active low. Addresses and data are latched on the rising edge of the WE # pulse. 
/Vcc |__|. DEVICE POWER SUPPLY (5V + 10%, 5V + 5%) 


OUTPUT ENABLE: Gates the device’s outputs through the data buffers during a 
read cycle. OE # is active low. 
| WE# 
PROGRAM/ERASE POWER SUPPLY: For erasing memory array blocks or 
programming data in each block. 
i eer ees GROUND: For all internal circuitry. 
reS aes ea NO CONNECT: Pin may be driven or left floating. 
Tie BE 


ee 2 WRITE ENABLE: Controls writes to the Command Register and array blocks. WE # 
Vpp 
Note: Vpp < Vpp_max Memory contents cannot be altered. 
DON’T USE PIN: Pin should not be connected to anything. 
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2.0 28F200BX WORD/BYTE-WIDE PRODUCTS DESCRIPTION 
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Figure 6. 28F200BX Word/Byte-Wide Block Diagram 
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2.1 28F200BX Memory Organization 


2.1.1 BLOCKING 


The 28F200BX uses a blocked array architecture to 
provide independent erasure of memory blocks. A 
block is erased independently of other blocks in the 
array when an address is given within the block ad- 
dress range and the Erase Setup and Erase Confirm 
commands are written to the CUI. The 28F200BxX is 
a random read/write memory, only erasure is per- 
formed by block. 


2.1.1.1 Boot Block Operation and Data 
Protection 


The 16-Kbyte boot block provides a lock feature for 
secure code storage. The intent of the boot block is 
to provide a secure storage area for the kernel code 
that is required to boot a system in the event of pow- 
er failure or other disruption during code update. 
This lock feature ensures absolute data integrity by 
preventing the boot block from being written or 
erased when RP # is not at 12V. The boot block can 
be erased and written when RP # is held at 12V for 
the duration of the erase or program operation. This 
allows customers to change the boot code when 
necessary while providing security when needed. 
See the Block Memory Map section for address 
locations of the boot block for the 28F200BX-T 
and 28F200BX-B. 


2.1.1.2 Parameter Block Operation 


The 28F200BX has 2 parameter blocks (8 Kbytes 
each). The parameter blocks are intended to provide 
storage for frequently updated system parameters 
and configuration or diagnostic information. The pa- 
rameter blocks can also be used to store additional 
boot or main code. The parameter blocks however, 
do not have the hardware write protection feature 
. that the boot block has. The parameter blocks pro- 
vide for more efficient memory utilization when deal- 
ing with parameter changes versus regularly blocked 
devices. See the Block Memory Map section for ad- 
dress locations of the parameter blocks for the 
. 28F200BX-T and 28F200BX-B. 
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Two main blocks of memory exist on the 28F200BX 
(1 x 128 Kbyte block and 1 x 96-Kbyte block). See 
the following section on Block Memory Map for the 
address location of these blocks for the 28F200BX-T 
and 28F200BX-B products. 


2.1.1.3 Main Block Operation 


2.1.2 BLOCK MEMORY MAP 


Two versions of the 28F200BX product exist to sup- 
port two different memory maps of the array blocks 
in order to accommodate different microprocessor 
protocols for boot code location. The 28F200BX-T 
memory map is inverted from the 28F200BX-B 
memory map. 


2.1.2.1 28F200BX-B Memory Map 


The 28F200BX-B device has the 16-Kbyte boot 
block located from O0000H to 01FFFH to accommo- 
date those microprocessors that boot from the bot- 
tom of the address map at OOOOOH. In the 
28F200BX-B the first 8-Kbyte parameter block re- 
sides in memory space from 02000H to O2FFFH. 
The second 8-Kbyte parameter block resides in 
memory space from O3000H to O3FFFH. The 
96-Kbyte main block resides in memory space from 
04000H to OFFFFH. The 128-Kbyte main block re- 
sides in memory space from 10000H to 1FFFFH 
(word locations). See Figure 7. 


(Word Addresses) 
1FFFFH 


128-Kbyte MAIN BLOCK 


10000H 
OFFFFH 


96-Kbyte MAIN BLOCK 
04000H 
O3FFFH 


03000H 
O2FFFH 


02000H 
O1FFFH 


8-Kbyte PARAMETER BLOCK 


8-Kbyte PARAMETER BLOCK 


16-Kbyte BOOT BLOCK 
00000H 


Figure 7. 28F200BX-B Memory Map 
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2.1.2.2 28F200BX-T Memory Map 


The 28F200BX-T device has the 16-Kbyte boot 
block located from 1E000H to 1FFFFH to accommo- 
date those microprocessors that boot from the top 
of the address map. In the 28F200BX-T the first 
8-Kbyte parameter block resides in memory space 
from 1D000H to 1DFFFH. The second 8-Kbyte pa- 
rameter block resides in memory space from 
1COO0H to 1CFFFH. The 96-Kbyte main block re- 
sides in memory space from 10000H to 1BFFFH. 
The 128-Kbyte main block resides in memory space 
from O00000H to OFFFFH as shown in Figure 8. 
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(Word Addresses) 


1FFFFH 
16-Kbyte BOOT BLOCK 
1E000H 


8-Kbyte PARAMETER BLOCK 


1DFFFH 


1D000H 
1CFFFH 


1CO00H 
1BFFFH 


8-Kbyte PARAMETER BLOCK 


96-Kbyte MAIN BLOCK 


10000H 
OFFFFH 


128-Kbyte MAIN BLOCK 


00000H 


Figure 8. 28F200BX-T Memory Map 
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3.0 28F002BX BYTE-WIDE PRODUCTS DESCRIPTION 
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Figure 9. 28F002BX Byte-Wide Block Diagram 
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3.1 28F002BX Memory Organization 


3.1.1 BLOCKING 


The 28F002BX uses a blocked array architecture to 
provide independent erasure of memory blocks. A 
block is erased independently of other blocks in the 
array when an address is given within the block ad- 
dress range and the Erase Setup and Erase Confirm 
commands are written to the CUI. The 28FO002BxX is 
a random read/write memory, only erasure is per- 
formed by block. 


3.1.1.1 Boot Block Operation and Data 
Protection 


The 16-Kbyte boot block provides a lock feature for 
secure code storage. The intent of the boot block is 
to provide a secure storage area for the kernel code 
that is required to boot a system in the event of pow- 
er failure or other disruption during code update. 
This lock feature ensures absolute data integrity by 
preventing the boot block from being programmed 
or erased when RP # is not at 12V. The boot block 
can be erased and programmed when RP # is held 
at 12V for the duration of the erase or program oper- 
ation. This allows customers to change the boot 
code when necessary while still providing: security 
when needed. See the Block Memory Map section 
for address locations of the boot block for the 
28F002BX-T and 28F002BxX-B. 


3.1.1.2 Parameter Block Operation 


The 28F002BX has 2 parameter blocks (8 Kbytes 
each). The parameter blocks are intended to provide 
storage for frequently updated system parameters 
and configuration or diagnostic information. The pa- 
rameter blocks can also be used to store additional 
boot or main code. The parameter blocks however, 
do not have the hardware write protection feature 
that the boot block has. Parameter blocks provide 
for more efficient memory utilization when dealing 
with small parameter changes versus regularly 
blocked devices. See the Block Memory Map sec- 
tion for address locations of the parameter blocks 
for the 28FO02BX-T and 28F002BX-B. 
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3.1.1.3 Main Block Operation 


Two main blocks of memory exist on the 28FO02BX 
(1 x 128-Kbyte block and 1 x 96-Kbyte block). See 
the following section on Block Memory Map for 
address location of these blocks for the 
28F002BX-T and 28F002BX-B. 


3.1.2 BLOCK MEMORY MAP 


Two versions of the 28F002BX product exist to sup- 
port two different memory maps of the array blocks 
in order to accommodate different microprocessor 
protocols for boot code location. The 28F002BX-T 
memory map is inverted from the 28F002BX-B 
memory map. 


3.1.2.1 28FO002BX-B Memory Map 


The 28F002BX-B device has the 16-Kbyte boot 
block located from O0000H to OSFFFH to accommo- 
date those microprocessors that boot from the bot- 
tom of the address map at OOOOOH. In the 
28F002BX-B the first 8-Kbyte parameter block re- 
sides in memory from 04000H to O5FFFH. The sec- 
ond 8-Kbyte parameter block resides in memory 
space from 06000H to O7FFFH. The 96-Kbyte main 
block resides in memory space from O8000H to 
1FFFFH. The 128-Kbyte main block resides in mem- 
ory space from 20000H to 3FFFFH. See Figure 10. 


SFFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


96-Kbyte MAIN BLOCK 
08000H 
07FFFH 


06000H 
O5FFFH 


04000H 
O3FFFH 


8-Kbyte PARAMETER BLOCK 


8-Kbyte PARAMETER BLOCK 


16-Kbyte BOOT BLOCK 
00000H 


Figure 10. 28F002BX-B Memory Map 
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3.1.2.2 28FO02BX-T Memory Map 


The 28F002BX-T device has the 16-Kbyte boot 
block located from 3CO00H to 3FFFFH to accom- 
modate those microprocessors that boot from the 
top of the address map. In the 28F002BX-T the first 
8-Kbyte parmeter block resides in memory space 
from 3A000H to 3BFFFH. The second 8-Kbyte pa- 
rameter block resides in memory space from 
38000H to 39FFFH. The 96-Kbyte main block re- 
sides in memory space from 20000H to 37FFFH. 
The 128-Kbyte main block resides in memory space 
from OOO00H to 1FFFFH. 


16-Kbyte BOOT BLOCK 


8-Kbyte PARAMETER BLOCK 


3FFFFH 


3CO00H 
3BFFFH 


3A000H 
39FFFH 


38000H 
37FFFH 


8-Kbyte PARAMETER BLOCK 


96-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128-Kbyte MAIN BLOCK 
Figure 11. 28FOO2BX-T Memory Map 
4.0 PRODUCT FAMILY PRINCIPLES 


OF OPERATION 


Flash memory augments EPROM functionality with 
in-circuit electrical write and erase. The 2-Mbit flash 
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family utilizes a Command User Interface (CUI) and 
internally generated and timed algorithms to simplify 
write and erase operations. 


The CUI allows for 100% TTL-level control inputs, 
fixed power supplies during erasure and program- 
ming, and maximum EPROM compatibility. 


In the absence of high voltage on the Vpp pin, the 
2-Mbit boot block flash family will only successfully 
execute the following commands: Read Array, Read 
Status Register, Clear Status Register and Intelli- 
gent Identifier mode. The device provides standard 
EPROM read, standby and output disable opera- 
tions. Manufacturer Identification and Device Identi- 
fication data can be accessed through the CUI or 
through the standard EPROM Ag high voltage ac- 
cess (Vip) for PROM programming equipment. 


The same EPROM read, standby and output disable 
functions are available when high voltage is applied 
to the Vpp pin. In addition, high voltage on Vpp al- 
lows write and erase of the device. All functions as- 
sociated with altering memory contents: write and 
erase, Intelligent Identifier read and Read Status are 
accessed via the CUI. 


The purpose of the Write State Machine (WSM) is to 
completely automate the write and erasure of the 
device. The WSM will begin operation upon receipt 
of a signal from the CUI and will report status back 
through a Status Register. The CUI will handle the 
WE # interface to the data and address latches, as 
well as system software requests for status while the 
WSN is in operation. 


4.1 28F200BX Bus Operations 


Flash memory reads, erases and writes in-system 
via the local CPU. All bus cycles to or from the flash 
memory conform to standard microprocessor bus 
cycles. 
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Table 1. Bus Operations for WORD-WIDE Mode (BYTE # = Vip) 


Standby 
Deep Power-Down 


NOTES: 

1. Refer to DC Characteristics. 

X can be Vi, or Viy for control pins and addresses, Vpp, or Vppy for Vpp. 

. See DC characteristics for Vpp_, VppH, VHH, Vip voltages. 

. Manufacturer and Device codes may also be accessed via a CUI write sequence. Ay—-A 37 = X. 
Device ID = 2274H for 28F200BX-T and 2275H for 28F200BX-B. 

. Refer to Table 4 for valid Diy during a write operation. 

. Command writes for Block Erase or Word/Byte Write are only executed when Vpp = Vppy. 

. TO write or erase the boot block, hold RP# at Vip. 

. RP# must be at GND +0.2V to meet the 1.2 »A maximum deep power-down current. 


ODNOOARWH 
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4.2 28F002BX Bus Operations 
Table 3. Bus Operations 


ViL 
ViL 
Write ViH 
NOTES: 
1. Refer to DC Characteristics. 
2. X can be Vi, or Viq for control pins and addresses, Vpp, or Vppy for Vpp. 
3. See DC characteristics for Vpp_, VppH, VHH, Vip voltages. 
4. Manufacturer and Device codes may also be accessed via a CUI write sequence. A;—-Aig = X. 
5. Device ID = 7CH for 28FO002BX-T and 7DH for 28FO02BX-B. 
6. Refer to Table 4 for valid Dijj during a write operation. 
7. Command writes for Block Erase or byte program are only executed when Vpp = Vppy. 
8. Program or erase the Boot block by holding RP# at Vu. 
9. RP# must be at GND +0.2V to meet the 1.2 wA maximum deep power-down current. 


4.3 Read Operations 


The 2-Mbit boot block flash family has three user 
read modes; Array, Intelligent Identifier, and Status 
Register. Status Register read mode will be dis- 
cussed in detail in the ‘Write Operations” section. 


During power-up conditions (Vcc supply ramping), it 
takes a maximum of 600 ns from when Vcc is at 
4.5V minimum to valid data on the outputs. 


4.3.1 READ ARRAY 


lf the memory is not in the Read Array mode, it is 
necessary to write the appropriate read mode com- 
mand to the CUI. The 2-Mbit boot block flash family 
has three control functions, all of which must be logi- 
cally active, to obtain data at the outputs. Chip-En- 
able CE# is the device selection control. Power- 
Down RP # is the device power control. Output-En- 
able OE# is the DATA INPUT/OUTPUT (DQ[0:15] 
or DQ[0:7]) direction control and when active is 
used to drive data from the selected memory on to 
the I/O bus. 


4.3.1.1 Output Control 


With OE# at logic-high level (Vj), the output from 
the device is disabled and data input/output pins 
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(DQ[0:15] or DQ[0:7]) are tri-stated. Data input is 
then controlled by WE#. 


4.3.1.2 Input Control 


With WE # at logic-high level (Vj), input to the de- 
vice is disabled. Data Input/Output pins (DQ-[0:15] 
or DQ[0:7]) are controlled by OE#. 


4.3.2 INTELLIGENT IDENTIFIERS 


28F200BX Products 


The manufacturer and device codes are read via the 
CUI or by taking the Ag pin to 12V. Writing 90H to 
the CUI places the device into Intelligent Identifier 
read mode. A read of location OOOOOH outputs the 
manufacturer’s identification code, 0089H, and loca- 
tion 00001H outputs the device code; 2274H for 
28F200BX-T, 2275H for 28F200BX-B. When 
BYTE# is at a logic low only the lower byte of the 
above signatures is read and DQ;5/A_, is a “don’t 
care” during Intelligent Identifier mode. A read array 
command must be written to the CUI to return to the 
read array mode. 
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The manufacturer and device codes are also read 
via the CUI or by taking the A9 pin to 12V. Writing 
90H to the CUI places the device into Intelligent 
Identifier read mode. A read of location O0000H out- 
puts the manufacturer’s identification code, 89H, 
and location 00001H outputs the device code; 7CH 
for 28FOO02BX-T, 7DH for 28F002BX-B. 


4.4 Write Operations 


Commands are written to the CUI using standard mi- 
croprocessor write timings. The CUI serves as the 
interface between the microprocessor and the inter- 
nal chip operation. The CUI can decipher Read Ar- 
ray, Read Intelligent Identifier, Read Status Register, 
Clear Status Register, Erase and Program com- 
mands. In the event of a read command, the CUI 
simply points the read path at either the array, the 
intelligent identifier, or the status register depending 
on the specific read command given. For a program 
or erase cycle, the CUI informs the write state ma- 
chine that a write or erase has been requested. Dur- 
ing a program cycle, the Write State Machine will 
control the program sequences and the CUI will only 
respond to status reads. During an erase cycle, the 
CUI will respond to status reads and erase suspend. 
After the Write State Machine has completed its 
task, it will allow the CUI to respond to its full com- 
mand set. The CUI will stay in the current command 
state until the microprocessor issues another com- 
mand. 


The CUI will successfully initiate an erase or write 
operation only when Vpp is within its voltage range. 
Depending upon the application, the system design- 
er may choose to make the Vpp power supply 
switchable, available only when memory updates 
are desired. The system designer can also choose 


to ‘‘hard-wire” Vpp to 12V. The 2 Mbit boot block. 


flash family is designed to accommodate either de- 
sign practice. It is recommended that RP # be tied to 
logical Reset for data protection during unstable 
CPU reset function as described in the ‘Product 
Family Overview” section. 
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4.4.1 BOOT BLOCK WRITE OPERATIONS 


In the case of Boot Block modifications (write and 
erase), RP# is set to Vy = 12V typically, in addi- 
tion to Vpp at high voltage. However, if RP # is not at 
VHH when a program or erase operation of the boot 
block is attempted, the corresponding status register 
bit (Bit 4 for Program and Bit 5 for Erase, refer to 
Table 5 for Status Register Definitions) is set to indi- 
cate the failure to complete the operation. 


4.4.2 COMMAND USER INTERFACE (CUI) 


The Command User Interface (CUI) serves as the 
interface to the microprocessor. The CUI points the 
read/write path to the appropriate circuit block as 
described in the previous section. After the WSM 
has completed its task, it will set the WSM Status bit 
to a “1’’, which will also allow the CUI to respond to 
its full command set. Note that after the WSM has 
returned control to the CUI, the CUI will remain in its 
current state. 


4.4.2.1 Command Set 


Command Device Mode 
Codes 


Invalid/Reserved 

Alternate Program Setup 
Erase Setup — 

Program Setup 

Clear Status Register 

Read Status Register 
Intelligent Identifier 

Erase Suspend 

Erase Resume/Erase Confirm 
Read Array 


4.4.2.2 Command Function Descriptions 


Device operations are selected by writing specific 
commands into the CUI. Table 4 defines the 2-Mbit 
boot block flash family commands. 
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Table 4. Command Definitions 


NOTES: 
1. Bus operations are defined in Tables 1, 2, 3. 


First Bus Cycle 


i 


Second Bus Cycle 


Kiso 
HD | 
SRD 
ae 
DOH 


= 


Dor 


= 


2. |A = Identifier Address: OOH for manufacturer code, 01H for device code. 


3. SRD = Data read from Status Register. 
4. ID = Intelligent Identifier Data. 


Following the Intelligent Identifier Command, two read operations access manufacturer and device codes. 


5. BA = Address within the block being erased. 
_6. PA = Address to be programmed. 

PD = Data to be programmed at location PA. 
7. Either 40H or 10H command is valid. 


8. When writing commands to the device, the upper data bus [DQ8-DQ15] = 


Vgss to avoid burning additional current. 


Invalid/Reserved 


These are unassigned commands. It is not recom- 
mended that the customer use any command other 
than the valid commands specified above. Intel re- 
serves the right to redefine these codes for future 
functions. 


Read Array (FFH) 


This single write command points the read path at 
the array. If the host CPU performs a CE#/OE# 
controlled read immediately following a two-write se- 
quence that started the WSM, then the device will 
output status register contents. If the Read Array 
command is given after Erase Setup the device is 
reset to read the array. A two Read Array command 
sequence (FFH) is required to reset to Read Array 
after Program Setup. 


Intelligent Identifier (90H) 


After this command is executed, the CUI points the 
output path to the Intelligent Identifier circuits. Only 
Intelligent Identifier values at addresses 0 and 1 can 
be read (only address AO is used in this mode, all 
other address inputs are ignored). 
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X (28F200Bx-only) which is either Voc or 


Read Status Register (70H) 


This is one of the two commands that is executable 
while the state machine is operating. After this com- 
mand is written, a read of the device will output the 
contents of the status register, regardless of the ad- 
dress presented to the device. 


The device automatically enters this mode after pro- 
gram or erase has completed. 


Clear Status Register (50H) 


The WSM can only set the Program Status and 
Erase Status bits in the status register, it can not 
clear them. Two reasons exist for operating the 
status register in this fashion. The first is a synchro- 
nization. The WSM does not know when the host 
CPU has read the status register, therefore it would 
not know when to clear the status bits. Secondly, if 
the CPU is programming a string of bytes, it may be 
more efficient to query the status register after pro- 
gramming the string. Thus, if any errors exist while 
programming the string, the status register will return 
the accumulated error status. 
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Program Setup (40H or 10H) 


This command simply sets the CUI into a state such 
that the next write will load the address and data 
registers. Either 40H or 10H can be used for Pro- 
gram Setup. Both commands are included to ac- 
commodate efforts to achieve an industry standard 
command code set. : 


Program 


The second write after the program setup command, 
will latch addresses and data. Also, the CUI initiates 
the WSM to begin execution of the program algo- 
rithm. While the WSM finishes the algorithm, the de- 
vice will output Status Register contents. Note that 
the WSM cannot be suspended during program- 
ming. 


Erase Setup (20H) 


Prepares the CUl for the Erase Confirm command. 
No other action is taken. If the next command is not 
an Erase Confirm command then the CUI will set 
both the Program Status and Erase Status bits of the 
Status Register to a ‘1’, place the device into the 
Read Status Register state, and wait for another 
command. 


Erase Confirm (DOH) 


If the previous command was an Erase Setup com- 
mand, then the CUI will enable the WSM to erase, at 
the same time closing the address and data latches, 
and respond only to the Read Status Register and 
Erase Suspend commands. While the WSM is exe- 
cuting, the device will output Status Register data 
when OE # is toggled low. Status Register data can 
only be updated by toggling either OE # or CE # low. 


Erase Suspend (BOH) 


This command only has meaning while the WSM is 
executing an Erase operation, and therefore will only 
be responded to during an erase operation. After 
this command has been executed, the CUI will set 
an output that directs the WSM to suspend Erase 
operations, and then return to responding to only 
Read Status Register or to the Erase Resume com- 
mands. Once the WSM has reached the Suspend 
state, it will set an output into the CUI which allows 
the CUI to respond to the Read Array, Read Status 
Register, and Erase Resume commands. In this 
mode, the CUI will not respond to any other com- 
mands. The WSM will also set the WSM Status bit to 
a “1”. The WSM will continue to run, idling in the 
SUSPEND state, regardless of the state of all input 
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control pins, with the exclusion of RP#. RP# will 
immediately shut down the WSM and the remainder 
of the chip. During a suspend operation, the data 
and address latches will remain closed, but the ad- 
dress pads are able to drive the address into the 
read path. 


Erase Resume (DOH) 


This command will cause the CUI to clear the Sus- 
pend state and set the WSM Status bit to a “0’’, but 
only if an Erase Suspend command was previously 
issued. Erase Resume will not have any effect in all 
other conditions. 


4.4.3 STATUS REGISTER 


The 2-Mbit boot block flash family contains a status 
register which may be read to determine when a pro- 
gram or erase operation is complete, and whether 
that operation completed successfully. The status 
register may be read at any time by writing the Read 
Status command to the CUI. After writing this com- 
mand, all subsequent Read operations output data 
from the status register until another command is 
written to the CUI. A Read Array command must be 
written to the CUI to return to the Read Array mode. 


The status register bits are output on DQ[0:7] 
whether the device is in the byte-wide (x8) or word- 
wide (x16) mode for the 28F200BxX. In the word-wide 
mode the upper byte, DQ[8:15] is set to OOH during 
a Read Status command. In the byte-wide mode, 
DQ[8:14] are tri-stated and DQ15/A—1 retains the 
low order address function. 


It should be noted that the contents of the status 
register are latched on the falling edge of OE# or 
CE# whichever occurs last in the read cycle. This 
prevents possible bus errors which might occur if the 
contents of the status register change while reading 
the status register. CE# or OE# must be toggled 
with each subsequent status read, or the completion 
of a program or erase operation will not be evident. 


The Status Register is the interface between the mi- 
croprocessor and the Write State Machine (WSM). 
When the WSM is active, this register will indicate 
the status of the WSM, and will also hold the bits 
indicating whether or not the WSM was successful in 
performing the desired operation. The WSM sets 
status bits “Three” through “Seven” and clears bits 
“Six” and “Seven”, but cannot clear status bits 
“Three” through “Five”. These bits can only be 
cleared by the controlling CPU through the use of 
the Clear Status Register command. 
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4.4.3.1 Status Register Bit Definition 


Table 5. Status Register Definitions 


7 6 5 4 3 2 1 0 


RASE SUSPEND STATUS 
rase Suspended 
rase in Progress/Completed 


SR.5 = ERASE STATUS 
1 Error in Block Erasure 
0 


Successful Block Erase 


SR.4 = PROGRAM STATUS 
1 = Error in Byte/Word Program 
0 = Successful Byte/Word Program 


Vpp STATUS 
pp Low Detect; Operation Abort 


SR.2-SR.0 = RESERVED FOR FUTURE ENHANCE- 
MENTS 


4.4.3.2 Clearing the Status Register 


Certain bits in the status register are set by the write 
state machine, and can only be reset by the system 
software. These bits can indicate various failure con- 
ditions. By allowing the system software to control 
the resetting of these bits, several operations may 


be performed (such as cumulatively programming © 


several bytes or erasing multiple blocks in se- 
quence). The status register may then be read to 
determine if an error occurred during that program- 
ming or erasure series. This adds flexibility to the 
way the device may be programmed or erased. To 
clear the status register, the Clear Status Register 
command is written to the CUI. Then, any other 
command may be issued to the CUI. Note again that 
before a read cycle can be initiated, a Read Array 
command must be written to the CUI to specify 
whether the read data is to come from the array, 
status register, or Intelligent Identifier. 
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NOTES: 


Write State Machine Status bit must first be checked to 
determine byte/word program or block erase completion, 
before the Program or Erase Status bits are checked for 
success. 


When Erase Suspend is issued, WSM halts execution 
and sets both WSMS and ESS bits to ‘1’. ESS bit re- 
mains set to “1” until an Erase Resume command is is- 
sued. 


When this bit is set to “1”. WSM has applied the maxi- 
mum number of erase pulses to the block and is still un- 
able to successfully perform an erase verify. 


When this bit is set to “1”, WSM has attempted but failed 
to Program a byte or word. 


The Vpp Status bit, unlike an A/D converter, does not 
provide continuous indication of Vpp level. The WSM in- 
terrogates the Vpp level only after the byte write or block 
erase Command sequences have been entered and in- 
forms the system if Vpp has not been switched on. The 
Vpp Status bit is not guaranteed to report accurate feed- 
back between Vpp, and Vppy. 


These bits are reserved for future use and should be 
masked out when polling the Status Register. 


4.4.4 PROGRAM MODE 


Program is executed by a two-write sequence. The 
Program Setup command is written to the CUI fol- 
lowed by a second write which specifies the address 
and data to be programmed. The write state ma- 
chine will execute a sequence of internally timed 
events to: 

1. Program the desired bits of the addressed memo- 

ry word (byte), and 


2. Verify that the desired bits are sufficiently pro- 
grammed 


Programming of the memory results in specific bits 


_ within a byte or word being changed to a “0”. 


If the user attempts to program ‘‘1’’s, there will be no 
change of the memory cell content and no error oc- 
curs. 


Similar to erasure, the status register indicates 
whether programming is complete. While the pro- 
gram sequence is executing, bit 7 of the status regis- 
ter is a “0”. The status register can be polled by 
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toggling either CE# or OE# to determine when the 
program sequence is complete. Only the Read 


Status Register command is valid while program- 
ming is active. 


When programming is complete, the status bits, 
which indicate whether the program operation was 
successful, should be checked. If the programming 
operation was unsuccessful, Bit 4 of the status regis- 
ter is set to a “1” to indicate a Program Failure. If Bit 
3 is set then Vpp was not within acceptable limits, 
and the WSM will not execute the programming se- 
quence. 


The status register should be cleared before at- 
tempting the next operation. Any CUI instruction can 
follow after programming is completed; however, it 
must be recognized that reads from the memory, 
status register, or Intelligent Identifier cannot be ac- 
complished until the CU! is given the appropriate 
‘command. A Read Array command must first be giv- 
en before memory contents can be read. 


Figure 12 shows a system software flowchart for de- 
vice byte programming operation. Figure 13 shows a 
similar flowchart for device word programming oper- 
ation (28F200BX-only). 


4.4.5 ERASE MODE 


Erasure of a single block is initiated by writing the 
Erase Setup and Erase Confirm commands to the 
CUI, along with the addresses, A[12:16] for the 
28F200BX or A[12:17] for the 28F002Bx, identifying 
the block to be erased. These addresses are latched 
internally when the Erase Confirm command is is- 
sued. Block erasure results in all bits within the block 
being set to “1”. 


The WSM will execute a sequence of internally 
timed events to: 


1. Program all bits within the block 


2. Verify that all bits within the block are sufficiently 
programmed © | 


3. Erase all bits within the block and 


4. Verify that all bits within the block are sufficiently 
erased 


While the erase sequence is executing, Bit 7 of the 
status register is a “O”’. 


When the status register indicates that erasure is 
complete, the status bits, which indicate whether the 
erase operation was successful, should be checked. 
If the erasure operation was unsuccessful, Bit 5 of 
the status register is set to a “1” to indicate an 
Erase Failure. If Vpp was not within acceptable limits 
after the Erase Confirm command is issued, the 
WSM will not execute an erase sequence; instead, 
Bit 5 of the status register is set to a “1” to indicate 
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an Erase Failure, and Bit 3 is set to a “1” to identify 
that Vpp supply voltage was not within acceptable 
limits. | 


The status register should be cleared before at- 
tempting the next operation. Any CUI instruction can 
follow after erasure is completed; however, it must 
be recognized that reads from the memory array, 
status register, or Intelligent Identifier can not be ac- 
complished until the CUI is given the appropriate 
command. A Read Array command must first be giv- 
en before memory contents can be read. 


Figure 14 shows a system software flowchart for 
Block Erase operation. 


4.4.5.1 Suspending and Resuming Erase 


Since an erase operation typically requires 1 to 3 
seconds to complete, an Erase Suspend command 
is provided. This allows erase-sequence interruption 
in order to read data from another block of the mem- 
ory. Once the erase sequence is started, writing the 
Erase Suspend command to the CUI requests that 
the Write State Machine (WSM) pause the erase se- 
quence at a predetermined point in the erase algo- 
rithm. The status register must be read to determine 
when the erase operation has been suspended. 


At this point, a Read Array command can be written 
to the CUl in order to read data from blocks other 
than that which is being suspended. The only other 
valid command at this time is the Erase Resume 
command or Read Status Register operation. 


Figure 15 shows a system software flowchart detail- 
ing the operation. 


During Erase Suspend mode, the chip can go into a 
pseudo-standby mode by taking CE # to Viy and the 
active current is now a maximum of 10 mA. If the 
chip is enabled while in this mode by taking CE # to 
Vit, the Erase Resume command can be issued to 


resume the erase operation. 


Upon completion of reads from any block other than 
the block being erased, the Erase Resume com- 
mand must be issued. When the Erase Resume 
command is given, the WSM will continue with the 
erase sequence and complete erasing the block. As 
with the end of erase, the status register must be 
read, cleared, and the next instruction issued in or- 
der to continue. 


4.4.66 EXTENDED CYCLING 


Intel has designed extended cycling capability into 
its ETOX Ill flash memory technology. The 2-Mbit 
boot block flash family is designed for 100,000 pro- 
gram/erase cycles on each of the five blocks. The 
combination of low electric fields, clean oxide pro- 
cessing and minimized oxide area per memory cell 


subjected to the tunneling electric field, results in 


very high cycling capability. 
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cfs Command Comments 
Operation 
Write 40H, Setup Data = 40H 
Byte Address Program Address = Byte to be 


programmed 


Write Byte Program Data tobe programmed » 
Address/Data Address = Byte to be 


programmed 


Read Status Status Register Data. 
Register Toggle OE # or CE # to update . 
Status Register 


Standby Check SR.7 
1 = Ready, 0 = Busy 


Repeat for subsequent bytes. 


YES 
Full Status Full status check can be done after each byte or after a 
Check If Desired | sequence of bytes. 


Byte Program Write FFH after the last byte programming operation to 
Completed reset the device to Read Array Mode. 


290448-6 


Full Status Check Procedure 


Status Register Data 
Read (See Above) 
Bus Command Comments 3 
Operation 


Error 1 = Vpp Low Detect 
Error 1 = Byte Program Error 


SR.3 MUST be cleared, if set during a program attempt, 


YES 
Byte Program before further attempts are allowed by the Write State 
Successful Machine. 


290448-7 SR.4 is only cleared by the Clear Status Register 
Command, in cases where multiple bytes are programmed 
before full status is checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 12. Automated Byte Programming Flowchart 
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Write 40H, 
Word Address 
Write Word 
Address/Data 


Read Status 
Register 


¥ES 


Full Status 
Check If Desired 


Word Program 
Completed 


Full Status Check Procedure 


Status Register Data 
Read (See Above) 


YES 


Word Program 
Successful 


290448-8 


Vpp Range 
Error 
Byte Program 
Error 
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ped Command Comments 
Operation 


Setup Data = 40H 

Program Address = Word to be 
programmed 

Program Data to be programmed 

Address = Word to be 

programmed 


Status Register Data. 


Toggle OE # or CE # to update 
Status Register 


Standby Check SR.7 


1 = Ready, 0 = Busy 
Repeat for subsequent words. 
Full status check can be done after each word or after a 


sequence of words. 


Write FFH after the last word programming operation to 
reset the device to Read Array Mode. 


OF anes Command Comments 
Operation 


Check SR.3 
1 = Vpp Low Detect 


Standby 


Check SR.4 
1 = Word Program Error 


Standby 


SR.3 MUST be cleared, if set during a program attempt, 
before further attempts are allowed by the Write State 
Machine. 


SR.4 is only cleared by the Clear Status Register 
Command, in cases where multiple words are programmed 
before full status is checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 13. Automated Word Programming Flowchart 
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Write 20H, 
Block Address 
Write DOH, 
Block Address 
Read Status 
Register 


Suspend Erase 
Loop 


Suspend 
Erase? 


YES 

Full Status 
Check If Desired 

Block Erase 

Completed 


Full Status Check Procedure 


Status Register Data 
Read (See Above) 


290448-10 


Vpp Range 
Error 
Command Sequence 
Error 
Block Erase 
Error 


YES 
Block Erase 
Successful 
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_— Command Comments 
Operation 


Data = 20H 
Address = Within block to be 
erased 


Data = DOH 
Address = Within block to be 
erased 


Status Register Data. 


Toggle OE # or CE# to update 
Status Register 


Check SR.7 
1 = Ready, 0 = Busy 


Standby 


Repeat for subsequent blocks. 


Full status check can be done after each block or after a 
sequence of blocks. 


Write FFH after the last block erase operation to reset the 
device to Read Array Mode. 


aus . Command Comments 
Operation 


Standby Check SR.3 


1 = Vpp Low Detect 


Check SR.4,5 


Both 1 = Command Sequence 
Error 


Check SR.5 
1 = Block Erase Error 


Standby 


SR.3 MUST be cleared, if set during an erase attempt, 
before further attempts are allowed by the Write State 
Machine. 


SR.5 is only cleared by the Clear Status Register 
Command, in cases where multiple blocks are erased 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 14. Automated Block Erase Flowchart 
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Write BOH 


Read Status 
Register 


5 


Y 


Erase Has 
TES Completed 


Write FFH 


Done 
Reading? 


al 


YES 


Write DOH 


Continue Erase 
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ous Command Comments 
Operation 


Erase Data = BOH 
Suspend 


Status Register Data. 
Toggle OE # or CE# to 
update Status Register 


Check SR.7 


Standby 
= Ready 


Standby Check SR.6 


1 = Suspended 


Read Array Data = FFH 


Read array data from block 
other than that being 
erased. 


Erase Resume | Data = DOH 


Figure 15. Erase Suspend/Resume Flowchart 


4.5 Power Consumption 


4.5.1 ACTIVE POWER 


With CE# at a logic-low level and RP# at a logic- 
high level, the device is placed in the active mode. 
The device Icc current is a maximum of 60 mA at 
10 MHz with TTL input signals. 


4.5.2 AUTOMATIC POWER SAVINGS 


Automatic Power Savings (APS) is a low power fea- 
ture during active mode of operation. The 2-Mbit 
family of products incorporate Power Reduction 
Control (PRC) circuitry which basically allows the de- 
vice to put itself into a low current state when it is 
not being accessed. After data is read from the 
memory array, PRC logic controls the device’s pow- 
er consumption by entering the APS mode where 
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maximum lIcc current is 3 mA and typical Icc current 
is 1 mA. The device stays in this static state with 
outputs valid until a new location is read. 


4.5.3 STANDBY POWER 


With CE# at a logic-high level (Vj), and the CUI in 
read mode, the memory is placed in standby mode 
where the maximum Icc standby current is 100 wA 
with CMOS input signals. The standby operation dis- 
ables much of the device’s circuitry and substantially 
reduces device power consumption. The outputs 
(DQ[0:15] or DQ[0:7]) are placed in a high-imped- 
ance state independent of the status of the OE# 
signal. When the 2-Mbit boot block flash family is 
deselected during erase or program functions, the 
devices will continue to perform the erase or pro- 
gram function and consume program or erase active 
power until program or erase is completed. 
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4.5.4 RESET/DEEP POWER-DOWN 


The 2-Mbit boot block flash family supports a typical 
loc of 0.2 A in deep power-down mode. One of the 
target markets for these devices is in portable equip- 
ment where the power consumption of the machine 
is of prime importance. The 2-Mbit boot block flash 
family has a RP# pin which places the device in the 
deep power-down mode. When RP # is at a logic- 
low (GND +0.2V), all circuits are turned off and the 
device typically draws 0.2 nA of Voc current. 


During read modes, the RP# pin going low dese- 


lects the memory and places the output drivers in a 
high impedance state. Recovery from the deep pow- 
er-down state, requires a minimum of 400 ns to ac- 
cess valid data (tpyay). 


During erase or program modes, RP # low will abort 
either erase or program operation. The contents of 
the memory are no longer valid as the data has been 
corrupted by the RP# function. As in the read mode 
above, all internal circuitry is turned off to achieve 
the 0.2 uA current level. 


RP# transitions to Vi, or turning power off to the 
device will clear the status register. 


This use of RP# during system reset is important 
with automated write/erase devices. When the sys- 
tem comes out of reset it expects to read from the 
flash memory. Automated flash memories provide 
status information when accessed during write/ 
erase modes. If a CPU reset occurs with no flash 
memory reset, proper CPU initialization would not 
occur because the flash memory would be providing 


the status information instead of array data. Intel’s — 


Flash Memories allow proper CPU initialization fol- 
lowing a system reset through the use of the RP# 


input. In this application RP# is controlled by the 


same RESET # signal that resets the system CPU. 


4.6 Power-Up Operation 


The 2-Mbit boot block flash family is designed: to 
offer protection against accidental block erasure or 
programming during power transitions. Upon power- 
up the 2-Mbit boot block flash family is indifferent as 
to which power supply, Vpp or Voc, powers-up first. 
Power suppy sequencing is not required. 


The 2-Mbit boot block flash family ensures the CUI is 
reset to the read mode on power-up. 


In addition, on power-up the user must either drop 
CE# low or present a new address to ensure valid 
data at the outputs. 


A system designer must guard against spurious 
writes for Vcc voltages above Vixo when Vpp is 


4-118 


intel. 


active. Since both WE# and CE# must be low for a 
command write, driving either signal to Vj will inhibit 
writes to the device. The CUI architecture provides 
an added level of protection since alteration of mem- 
ory contents can only occur after successful com- 
pletion of the two-step command sequences. Final- 
ly, the device is disabled until RP # is brought to Vip, 
regardless of the state of its control inputs. This fea- 
ture provides yet another level of memory protec- 
tion. 


4.7 Power Supply Decoupling 


Flash memory’s power switching characteristics re- 
quire careful device decoupling methods. System 
designers are interested in 3 supply current issues: 


e Standby current levels (Iccs) 
e Active current levels (Iccr) 


e Transient peaks produced by falling and rising 
edges of CE#. 


Transient current magnitudes depend on the device 
outputs’ capacitive and inductive loading. Two-line 
control and proper decoupling capacitor selection 
will suppress these transient voltage peaks. Each 
flash device should have a 0.1 F ceramic capacitor 
connected between each Vcc and GND, and be- 
tween its Vpp and GND. These high frequency, low- 
inherent inductance capacitors should be placed as 
close as possible to the package leads. 


4.7.1 Vpp TRACE ON PRINTED CIRCUIT 
BOARDS 


Writing to flash memories while they reside in the 
target system, requires special consideration of the 
Vpp power supply trace by the printed circuit board 
designer. The Vpp pin supplies the flash memory 
cell’s current for programming and erasing. One 
should use similar trace widths and layout consider- 
ations given to the Vcc power supply trace. Ade- 
quate Vpp supply traces and decoupling will de- 
crease spikes and overshoots. 


4.7.2 Voc, Vpp AND RP# TRANSITIONS 


The CUI latches commands as issued by system 
software and is not altered by Vpp or CE# tran- 
sitions or WSM actions. Its state upon power-up, af- 
ter exit from deep power-down mode or after Voc 
transitions below Vi Ko (Lockout voltage), is Read 
Array mode. 


After any word/byte write or block erase operation is 
complete and even after Vpp transitions down to 
Vppi, the CUI must be reset to Read Array mode via 
the Read Array command when accesses to the 
flash memory are desired. 
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ABSOLUTE MAXIMUM RATINGS* 


Commercial Operating Temperature 


ise FiGGE: v5. fsa tien hs dele ee 0°C to 70°C(1) 

During Block Erase 

and Word/Byte Write............... 0°C to 70°C 

Temperature Under Bias....... — 10°C to + 80°C 
Extended Operating Temperature 

During Meee ie. 5. Ce Ge Ges. — 40°C to + 85°C 

During Block Erase 

and Word/Byte Write ......... — 40°C to + 85°C 

Temperature Under Bias....... — 40°C to + 85°C 
Storage Temperature .......... 65°C to + 125°C 


Voltage on Any Pin 
(except Vcc, Vpp, Ag and RP #) 


with Respect toGND ........ —2.0V to +7.0V(2) 
Voltage on Pin RP# or Pin Ag 
with Respect toGND ..... —2.0V to + 13.5V(2, 3) 


Vpp Program Voltage with Respect 
to GND during Block Erase 


and Word/Byte Write ..... —2.0V to + 14.0V(2, 3) 
Voc Supply Voltage 

with Respect toGND........ —2.0V to +7.0V(2) 
Output Short Circuit Current............. 100 mA(4) 
NOTES: 


28F200BX-T/B, 28F002BX-T/B 


NOTICE: This data sheet contains information on 
products in the sampling and initial production phases 
of development. The specifications are subject to 


change without notice. Verify with your local Intel 
Sales office that you have the latest data sheet be- 
fore finalizing a design. 


*WARNING: Stressing the device beyond the “Absolute 
Maximum Ratings” may cause permanent damage. 
These are stress ratings only. Operation beyond the 
“Operating Conditions” is not recommended and ex- 
tended exposure beyond the “Operating Conditions” 
may affect device reliability. 


1. Operating temperature is for commercial product defined by this specification. 
2. Minimum DC voltage is —0.5V on input/output pins. During transitions, this level may undershoot to —2.0V for periods 
<20 ns. Maximum DC voltage on input/output pins is Voc + 0.5V which, during transitions, may overshoot to Voc + 2.0V 


for periods <20 ns. 


3. Maximum DC voltage on Vpp may overshoot to + 14.0V for periods <20 ns. Maximum DC voltage on RP# or Ag may 


overshoot to 13.5V for periods < 20 ns. 


4. Output shorted for no more than one second. No more than one output shorted at a time. 
5. 10% Voc specifications reference the 28F200BX-60/28F002BX-60 in their standard test configuration, and the 


28F200BX-80/28F002BX-80. 


6. 5% Vcc specifications reference the 28F200BX-60/28F002BX-60 in their high speed test configuration. 


OPERATING CONDITIONS 


| Symbol | ___Parameter 
/Ta___| Operat 


Operating Temperature 


Ta____| Operating Temperature 
Voc Supply Voltage (10%) 


Voc Supply Voltage (5%) 


ADVANCE INFORMATION 


Test Condition 


Voc = Voc Max 
Vin = Voc or GND 


Voc = Voc Max 
Vout = Voc or GND 
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DC CHARACTERISTICS (Continued) 


Symbol] Parameter 


Voc Standby Current 


sw ool ea — 


5 mA |Vcc = Vcc Max 
CE# = RP4# = Vin 
pA |\Vcc = Voc Max 
CE# = RP# = Vcc +0.2V 
28F200BX: 
BYTE# = Vcc +0.2V or GND 


Vcc Deep Power-Down Current CS ee RP# = GND +0.2V 

IocR Vcc Read Current for mA |Vcc = Voc Max, CE# = GND 
28F200BX Word-Wide and ts 16 f = 10 MHz, lout = OMA 
Byte-Wide Mode and | CMOS Inputs 


28F002BX Byte-Wide Mode mA |Vcc = Vcc Max, CE# = Vit 
f = 10 MHz, lout = OMA 
TTL Inputs 


loon Woe Word Byte Wite Curent [1.4 | | | 68 [mal word wntein Progress 
loce oc BlockErase Curent | 1.4] | | 90 [mal ockresoin Progress 


Voc Erase Suspend Current 2 


pps Vpp Standby Current eps ie 
Ippp Vpp Deep Power-Down Current 
IppR Vpp Read Current 


a 
Se?) 
eed 
‘dl sats 0 SR 


40 mA |Vpp = VppH 
Word Write in Progress 


mA |Vpp = VppH 
Byte Write in Progress 


mA |Vpp = VppH 
Block Erase in Progress 


Vpp = VpPH 
Block Erase Suspended 


Vpp Byte Write Current 
Vpp Block Erase Current 
Vpp Erase Suspend Current 


IRPe RP # Boot Block Unlock Current eget 4 
jo_—_|paniatiae ete Curot [1.4 [ 
(Mins 
Me 
nh 


Ag Intelligent Identifier Voltage | 
Input Low Voltage ee 
Input High Voltage Re 


Output Low Voltage 
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DC CHARACTERISTICS (Continued) 


VOH 
VHH 


Test Condition 


Voc = Vcc Min 


Output High Voltage 
lon = —2.5mA 


[nates mm 

a 

[vers | Vep during Nomel Operator [9 eee 
[Veen | Ver during Erase/Wiite Operations | 7 [114[rolve| v | 
[Veen | Vee during Erase/Wite Operations | 8 ee 
Wixo | Voo Erase/wte Lock Votege | _—_ rig Peat 
Tins [Ae Unock vonage | 


nik 
—_— 
oO 
ae 
ad 
fo) 


[tx | Operating Temperaure | | -a0 | +05 | -o_| 
[vce | Voo Supp Voiage 10%) [| 6 | 450 | so |v 


DC CHARACTERISTICS: EXTENDED TEMPERATURE OPERATION 


symbol] __—Parameter_—| Notes| Min| Typ | Max |Unit| Test Condition 
ly Input Load Current 1 +1.0} pA | Voc = Voc Max 
Vin = Voc or GND 
ILo Output Leakage Current 1 +10] yA | Voc = Voc Max 
Vout = Vcc or GND 


locs Voc Standby Current 1,3 1.5 | mA | Vcc = Voc Max 
CE# = RP# = Vip 
100 | BA | Voc = Voc Max 
CE# = RP# = Vcc +0.2V 
28F200BX: 
BYTE# = Voc +0.2V or GND 
Voc Deep Power-Down Current eee GE ae eg RP# = GND +0.2V 


IocR Voc Read Current for ai Os; mA | Vcc = Voc Max, CE# = GND 
28F200BX Word-Wide and 6 f = 10 MHz, lout = OMA 
CMOS Inputs 
sabe 1 ouelour= Oma | 


Byte-Wide Mode and 
28F002BX Byte-Wide Mode 

f = 10 MHz, loyt = OmA 
TTL Inputs 
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DC CHARACTERISTICS: EXTENDED TEMPERATURE OPERATION (Continued) 


[Typ] Max [Unit] Test Conattion | 
[70 | ma [Word wit in Progress 


10 mA | Block Erase Suspended 
CE# = Vip 


Parameter Notes 
Voc Word Byte Write Current 


Vcc Block Erase Current 


Iccw 
ICCE 


Icces_ | Vcc Erase Suspend Current 


Vpp Standby Current 

Vpp Deep Power-Down Current 
Vpp Read Current 

Vpp Word Write Current 


40 mA | Vpp = VpppH 
Word Write in Progress 
mA |Vpp = VpPH 
Byte Write in Progress 
mA |Vpp = VpPH 
Block Erase in Progress 
»A |Vpp = VppH 
Block Erase Suspended 


Vo [Ae ntetigent ener Votage | [uxs| | 130 | v_ 
Va |iputtowVomge | —*d=aaf | os |v] 
eee eres rie 


V 
VoL Output Low Voltage 0.45 V |Vcc = Vcc Min 
lo. = 5.8 mA 
VOH Output High Voltage 2.4 V |1Vcc = Voc Min 
’ lon = —2.5mA 


Veen [Vow dung Eese/WiteGperatons| 8 [108 |t20| 192 |v | 
Muxo [VecEreee/Wite Lock votes | _[20| | |v[ 
Vina [RP# Unlock votage | [118 | 180 | v [Boot block witerErase 


IpPpw Vpp Byte Write Current 


Vpp Block Erase Current 


Vpp Erase Suspend Current 


—s 


IRP# 


as i 
: : 
” 
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NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Voc = 5.0V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (packages and speeds). ) 
2. IccEs is specified with the device deselected. If the device is read while in Erase Suspend Mode, current draw is the sum 
of Icces and Iccr. 

3. Block Erases and Word/Byte Writes are inhibited when Vpp = Vpp, and not guaranteed in the range between Vppy and 
VPPL- | 

4. Sampled, not 100% tested. 

5. Automatic Power Savings (APS) reduces Iccr to less than 1 mA typical in static operation. 

6. CMOS Inputs are either Voc +0.2V or GND +0.2V. TTL Inputs are either Vi, or Vip. 

7. Vpp = 12.0V +5% for applications requiring 100,000 block erase cycles. 

8. Vpp = 12.0V +10% for applications requiring wider Vpp tolerances at 100 block erase cycles. 

9. For the 28F002BX, address pin Aj¢ follows the Coyt capacitance numbers. 

10. IccrR typical is 25 mA for X16 active read current. 


STANDARD TEST CONFIGURATION(1) 


STANDARD AC INPUT/OUTPUT REFERENCE WAVEFORM STANDARD AC TESTING 


2.4 2.0 2.0 
INPUT ; TEST POINTS “OUTPUT 
0.45 0.8 PR ge 0.8 


LOAD CIRCUIT 


290448-14 
AC test inputs are driven at Voy (2.4 Vt.) for a Logic “1” and Vo. 
(0.45 Vrt_) for a logic “0”. Input timing begins at Vjy (2.0 Vrz_) and Vi. 
(0.8 Vr7,_). Output timing ends at Vj and Vj,. Input rise and fall times (10% 
to 90%) < 10 ns. 


DEVICE 
UNDER 
TEST 


290448-13 
CL = 100 pF 
C,. Includes Jig Capacitance 
R_ = 3.3 KO 


HIGH SPEED TEST CONFIGURATION(2) 


HIGH SPEED AC INPUT/OUTPUT REFERENCE WAVEFORM HIGH SPEED AC TESTING 


LOAD CIRCUIT 
3.0 
INPUT ¥ 1.5 <—— TEST POINTS ——> ¥ 1.5 OUTPUT 
0.0 


290448-22 


AC test inputs are driven at 3.0V for a Logic “1” and 0.0V for a logic “0”. 
Input timing begins, and output timing ends, at 1.5V. Input rise and fall times 


(10% to 90%) < 10 ns. DEVICE 
UNDER 
TEST 
NOTES: 
1. Testing characteristics for 28F200BX-60/28F002BX-60 in standard test config- 
uration and 28F200BX-80/28F002BxX-80. = 
2. Testing characteristics for 28F200BX-60/28F002BX-60 in high speed test con- 290448-21 
figuration. — CL = 30 pF 


C. Includes Jig Capacitance 
Rp = 3.3 KN 
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AC CHARACTERISTICS—Read Only Operations(1) 


28F200BX-60(4) 28F200BX-605) | fan aenen 
28F002BX-60(4) | 28FO002BX-60(5) fan aenen 


Versions 


--r 
> 
< 
O 
< 

-- 
> 
?) 
@) 


Parameter 
Read Cycle Time 


Address to 
Output Delay 


tELqv |tce |CE# to Output Delay 


RP # High to 
Output Delay 


OE # to Output Dela 


toe 
CE # to Output Low 


CE # High to Output 
High Z 


OE # to Output Low Z 


OE # High to Output 
High Z 


: Output Hold from 


= 
> 
< 
> 
< 

+ 
D 
'@) 


a 


N 


300 


ronal 
0 
“5 
O 
< 

ote 
a 
= 
fa 


< 


— 
m 
a 
O 
N 
= 


Addresses, 
CE# or OE# Change, 
Whichever is First 


CE# to BYTE# 
Switching 
Low or High 


BYTE # Switching 
High to 
Valid Output Delay 


BYTE # Switching 
Low to 
Output High Z 


NO 
=) 


NOTES: 

1. See AC Input/Output Reference Waveform for timing measurements. 

2. OE# may be delayed up to tce-tog after the falling edge of CE # without impact on tce. 

3. Sampled, not 100% tested. 

4. See High Speed Test Configuration. 

5. See Standard Test Configuration. 

6. teLqv, BYTE# switching low to valid output delay, will be equal to tayqy, measured from the time DQ;5/A-; becomes 
valid. 
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EXTENDED TEMPERATURE OPERATIONS 
AC CHARACTERISTICS—Read Only Operations(1): 


Warelois T28F200BX-80(4) 
T28F002BX-80(4) 
|_ Symbol | Parameter 
tavav tacc Address to 
Output Delay 
tpHaV tpwH RP # High to 
Output Delay 
CE# to Output Low Z 


| Notes 

EDA 

Gaal 

Ge Px 

ore 

is ese 

High Z 
eg 
| bud 


LZ OE # to Output Low Z 


High Z 
to 


Output Hold from 
Addresses, 

CE # or OE# Change, 
Whichever is First 


CE# to BYTE# 
Switching 
Low or High 


BYTE # Switching 
High to 
Valid Output Delay 


BYTE # Switching 
Low to 
Output High Z 


NOTES: 

1. See AC Input/Output Reference Waveform for timing measurements. 

2. OE # may be delayed up to tce-tog after the falling edge of CE # without impact on tce. 

3. Sampled, not 100% tested. 

4. See Standard Test Configuration. 

5. teLqv, BYTE# switching low to valid output delay, will be equal to tayqy, measured from the time DQs/A-; becomes 
valid. 
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Voc POWER-UP 


DEVICE AND 


ADDRESS SELECTION OUTPUTS ENABLED 


me XO 


Vin 


Vin 


DATA (D/Q) 
Vi 


HIGH Z 


teLav 


tcLav 


teLax 
teLox 


tPHav 


DATA VALID 


tavav 


VALID OUTPUT 


tou 


STANDBY Voc POWER-DOWN 


HIN 


teHoz 


@/L-X8Z00482 ‘A/1-X800z48z 


tcHoz 


ANNE 
ALL LY ) 
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Pen a as "sl 
a A 


1-243 ee GO 7°89. 10.11 12 15-14 15.16 
FREQUENCY (MHz) 


} 2 3.4 3 6 7°88 107) 12 13165 18 
FREQUENCY (MHz) 


290448-26 290448-27 
Figure 17. lcc (RMS) vs Frequency Figure 18. icc (RMS) vs Frequency 
(Vcc = 5.5V) for x16 Operation (Vcc = 5.5V) for x8 Operation 


NUL 
NUL 
ec 


Tace (ns) 
ES Pc a a Te 
AY 
\e 
| 


ed 
oe 
a 


-—O— 
—— 


28F 200BX/28F002BX-60 
28F 200BX/28F002BX-80 


150 200 250 


OUTPUT CAPACITANCE (pF) 
290448-28 


Figure 19. Tacc vs Output Load 
Capacitance (Vcc = 4.5V, T = 70°C) 
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NOILVNEOANI JONVACYV 


DEVICE 
STANDBY ADDRESS SELECTION DATA VALID STANDBY 


cere | 100 GR 1008 


Vin 


ViL 
taver = tee 


a } - 


OE# (G) 


Vit 


Vin 
BYTE# (F) 


Vit 


Vin 


DATA OUTPUT cin SRA 
( E ) OUTPUT ON 
DATA (DQo —DQ, =« ON DQ, -DQ, \ DQ) -DQ, SH//f 


Vit 


Loz 


( DATA 

DATA (DQ, -DQ,, ) OUTPUT ONJ} 

tits a 
Y DATA 
(| outeur [HZ ADDRESS 
\ ON 00, INPUT 
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AC CHARACTERISTICS For WE #-Controlled Write Operations(1) 
Vec +5% Vcc + 10% 


28F200BX-60(9) | 28F200BX-60(19) | 28F200BX-80(10) 
28F002BX-60(9) | 28FO002BX-60(19) | 28FO002BX-80(10) 


Versions 


~ 
oO 


0 
= 
9) 
3 
® 
- 
® 
= 
= 
° 
- 
® 
“” 


Write Cycle Time 


tpHWL RP# High 
Recovery to 
WE # Going Low 


Bis 
teLwL |tcs |CE# Setup to WE# 

Going Low 
tps |RP# Viyy Setup to 2 
Bick 


215 


100 
WE # Going High 


tvpwH_ |tvps | Vpp Setup to WE # 
Going High 

tavwH |tas_ |Address Setup to 
WE # Going High 


100 


t Data SetuptoWE#| 4 
Going High 


we |WE# Pulse Width | | 
twHpDx |tpH |Data Hold from 4 
WE # High 
twHax |taH |Address Hold 3 
from WE # High 
ay 


-* 


Le 


100 
100 
10 
10 
10 


as 


—_ 
i) 


ks 
o) 


twHEH |tcH |CE# Hold from 
WE # High 

twHWL_ |tweH|WE# Pulse 
Width High 
Duration of 
Word/Byte Write 

tWHQV3 2,5 
(Parameter) 
Duration of Erase /|2,5,6 
Operation (Main) 

tow. | tvepH | Vpp Hold from 5;.8 
Valid SRD 


w 
8 


= 


Operation 


Duration of Erase /|2,5,6 
Operation (Boot) 


Duration of Erase 


co) 
G 


© 
7) 


=) 
1é) 


Operation 
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AC CHARACTERISTICS For WE #-Controlled Write Operations(!) (Continued) 


Vcc +5% Vcc + 10% 
Versions 28F200BX-60(19) | 28F200BX-60(19) | 28F200BX-80(10) 
28F002BX-60(9) | 28F002BX-60(10) | 28F002BX-80(10) 


tavPH | tpHH | RP# ViH Hold 
from Valid SRD 
tpHBR Boot-Block %¢ 
Relock Delay 
NOTES: 
1. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
characteristics during Read Mode. 
2. The on-chip WSM completely automates program/erase operations; program/erase algorithms are now controlled inter- 
nally which includes verify and margining operations. 
3. Refer to command definition table for valid Ajyj. 
4. Refer to command definition table for valid Dyy. 
5. Program/Erase durations are measured to valid SRD data (successful operation, SR.7 = 1). 
6. For Boot Block Program/Erase, RP# should be held at Vy} until operation completes successfully. 
7. Time tpyprR is required for successful relocking of the Boot Block. 
8. Sampled but not 100% tested. 


9. See High Speed Test Configuration. 
10. See Standard Test Configuration. 


BLOCK ERASE AND WORD/BYTE WRITE PERFORMANCE: Vpp = 12.0V +5% 


28F200BX-60 28F200BX-80 
Parameter 28F002BX-60 28F002BX-80 


Boot/Parameter 

Block Erase Time 

Main Block 

Erase Time 

Main Block Byte 
Program Time 

Main Block Word - 

Program Time 


NOTES: 
2. Excludes System-Level Overhead. 


BLOCK ERASE AND WORD/BYTE WRITE PERFORMANCE: Vpp = 12.0V + 10% 


28F200BX-60 28F200BX-80 
phic teee 28F002BX-60 28F002BX-80 


Boot/Parameter 
Block Erase Time 


Main Block 
Erase Time 
Main Block Byte 
Program Time 
Main Block Word 
Program Time 


NOTES: 
1. 25°C ' 
2. Excludes System-Level Overhead. 
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EXTENDED TEMPERATURE OPERATION 
AC CHARACTERISTICS For WE#-Controlled Write Operations(1): 


T28F200BX-80(9) 
(4) 
Versions T28F002BX-80(9) i 


[Symbot_[ Parameter Notes | in| Max 


blade  d 
WE # Going Low 


estes ih Data Setup to WE # Going High 
WE # Pulse Width 
| tp | Data Hold from WE# High 4 
Address Hold from WE # High 
CE # Hold from WE # High 
WE # Pulse Width High 


tWHOV1 Duration of Word/Byte 
Write Operation 
/ twHove |” Duration of Erase Operation (Boot) 
tWHQV3 Duration of Erase 
Operation (Parameter) 
twHova | | Duration of Erase Operation (Main) 
Vpp Hold from Valid SRD 


RP# Vin Hold from Valid SRD 
| tpysr |_| _ Boot-Block Relock Delay 


NOTES: 

1. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
characteristics during Read Mode. 

2. The on-chip WSM completely automates program/erase operations; program/erase algorithms are now controlled inter- 
nally which includes verify and margining operations. 

3. Refer to command definition table for valid Ajj. 

4. Refer to command definition table for valid Dyn. 

. Program/Erase durations are measured to valid SRD data (successful operation, SR.7= 1). 

. For Boot Block Program/Erase, RP# should be held at Vy until operation completes successfully. 

. Time tpyprR is required for successful relocking of the Boot Block. 

. Sampled but not 100% tested. 

. See Standard Test Configuration. 


2,5,6 


7,8 


OONOM 
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EXTENDED TEMPERATURE OPERATION 
BLOCK ERASE AND WORD/BYTE WRITE PERFORMANCE: Vpp = 12.0V +5% 


T28F200BX-80 

Parameter Notes T28F002BX-80 
Boot/Parameter j 
Block Erase Time 
Main Block 2 18 
Erase Time 
Main Block Byte 
Program Time 


Main Block Word: 
Program Time 


NOTES: 
1. 25°C, 12.0V Vpp. 
2. Excludes System-Level Overhead. 
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CEl-v 


WRITE 


“Voc POWER-UP = WRITE PROGRAM OR _—-VALID ADDRESS & DATA(PROGRAM) | AUTOMATED PROGRAM READ STATUS WRITE READ ARRAY 
& STANDBY ERASE SETUP COMMAND — OR ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER DATA COMMAND 
V 
1H eoes eas (een ee (\ XX XX VAY, ap Xx} xX XX XX | KX \/ p. {X XX Veh OO EES: x) 
BB RR NSE ew TRS RSD OO OK SAXONY 
tavaV tavWH tWHAX 
ViH 
CE# (E) 
Vib 
ELWL {WHEH 
Vin ¢ 
OE# (G) 
Vib 
twHav1,2,3,4 
Vin 
WE# (W) 
Vit ne 
tovwH a 
“4 wicH z LTR vauiw \\\ 
en ed K=Y © 
tPHHWH tovPH 
Vn ~ 
6.5V Y 
Vin 
RP# (P) 
Vib 
: tov : 
YOOX XXX KKK KX XXX RXXXKXXKXAKAX A KAA AKA 
100% REN ey Werner 
PP Vy NYY V, YYKX XK YY VAVAVAVAVAVAVAVAVAVAVAVAVAVAVAVAVAY, 
XY seLaclelecleteelecoetezoete 
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AC CHARACTERISTICS FOR CE#-CONTROLLED WRITE OPERATIONS(|, 9) 


28F002BX-60(10) | 28FO002BX-60(11) | 28FO002BX-80(11) 
Min 


RP # High Recovery 
to CE # Going Low 
WE # Setup to CE # 
Going Low 
tpys|RP# Vy Setup to 
CE # Going High 


VPEH |tvps!Vpp Setup to CE # 
: Going High 
AVEH |tas {Address Setup to 
CE # Going High 
H Data Setup to CE # 
Going High 


tcp [CE# Pulse Width 
EHDX |tpH |Data Hold from 

CE # High : 
EHAX |taH |Address Hold 

from CE # High 


EHWH |twH |WE# Hold from CE # High 
tcpH|CE # Pulse 


ie i 
EHQV1 Duration of Word/Byte us 
Programming 
Operation 
EHQV Duration of Erase 
Operation (Boot) 
EHQV Duration of Erase 
Operation (Parameter) 
EHQV. Duration of Erase 
Operation (Main) 
QWL_ |tvpH|Vpp Hold from 
Valid SRD 


= v0 i> 
fa ak ol Se 
m m |> 
e rj 


O 
< 
m 


m 
- 
m 
9 


100 
10 
10 

10 


=z 

i iN 2° 

© 

| =| lel =| a] af a| -| lols 


BS 


QVPH |tPHH|RP# VHH Hold 
from Valid SRD 


hm i Boot-Block Relock Delay 


m 

Fa 

m 
i) nN 


PHBR 


OE a Ce 
NOTES: 


1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of CE# and WE# in systems where 
CE# defines the write pulse-width (within a longer WE # timing waveform), all set-up, hold and inactive WE # time should be 
measured relative to the CE# waveform. 

2, 3, 4, 5, 6, 7, 8: Refer to AC Characteristics notes for WE #-Controlled Write Operations. 

9. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
Characteristics during Read Mode. 

10. See High Speed Test Configuration. 

11. See Standard Test Configuration. 


4-134 ADVANCE INFORMATION : 


2 : : | 7 
intel p | 28F200BX-T/B, 28F002BX-T/B 


EXTENDED TEMPERATURE OPERATION 
AC CHARACTERISTICS FOR CE #-CONTROLLED WRITE OPERATIONS(1, 9) 


T28F200BX-80(10) 
two Write Cycle Time 
S 


RP # High Recovery 
to CE# Going Low 
WE # Setup to CE # 
Going Low 

RP# Vip Setup to 
CE # Going High 


100 


oe 
= 
i 
m 
i 


tvPEH typs Vpp Setup to CE# 
Going High 

tAVEH ta Address Setup to 
CE # Going High 

toVEH Data Setup to CE # 
Going High 


top CE # Pulse Width 
tEHDx Data Hold from 
CE# High 
tEHAX taH Address Hold 
from CE # High 


twH WE # Hold from CE# High 


tEHEL tcPH CE# Pulse 
Width High 


tEHQV1 
Duration of Erase 


tEHQv2 
eo | Operation (Boot) 
tEHOV3 Duration of Erase 
Operation (Parameter) 


Duration of Word/Byte 


:— 


Programming 
Operation 


tEHOV4 Duration of Erase 
Operation (Main) 
tQwL tyPH Vpp Hold from 
Valid SRD 
tQvPH tPHH RP# Vin Hold 
from Valid SRD 
Boot-Block Relock Delay 
NOTES: 


1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of CE# and WE# in systems where 
CE# defines the write pulse-width (within a longer WE # timing waveform), all set-up, hold and inactive WE # time should be 
measured relative to the CE # waveform. 

2, 3, 4, 5, 6, 7, 8: Refer to AC Characteristics for WE #-Controlled Write Operations. 

9. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
Characteristics during Read Mode. 

10. See Standard Test Configuration. 
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ORDERING INFORMATION 


| fetzqaprizfofojesx|-|risjo 
PRA, SRST iy 1a 
Bs ACCESS SPEED (ns) 


OPERATING TEMPERATURE PACKAGE ma 

T = EXTENDED TEMP E = STANDARD 56 LEAD TSOP a ran 

BLANK = COMMERCIAL TEMP PA = 44 LEAD PSOP = 
B 


TB = 44 LEAD PSOP, EXTENDED TEMP 
290448-18 


Valid Combinations: 

E28F200BX-T60 PA28F200BX-T60 

E28F200BX-B60 PA28F200BX-B60 

E28F200BX-T80 PA28F200BX-T80 TE28F200BX-T80 TB28F200BX-T80 
E28F200BX-B80 PA28F200BX-B80 TE28F200BX-B80 TB28F200BX-B80 


| JE;2{strypojot2}eyx}-|risjo| 
Aare eee E 4 xt 
i ACCESS SPEED (ns) 


OPERATING TEMPERATURE PACKAGE 
T = EXTENDED TEMP E = STANDARD 40 LEAD TSOP 
BLANK = COMMERCIAL TEMP 


60ns 
80 ns 
290448-23 


Valid Combinations: 

E28F002BX-T60 

E28F002BX-B60 

E28F002BX-T80 TE28F002BX-T80 
E28F002BX-B80 TE28F002BX-B80 


ADDITIONAL INFORMATION Order Number 


28F400BX/28F004BX Datasheet 290451 
28F200BXL/28F002BXL Datasheet . 290449 
28F400BXL/28F004BXL Datasheet 290450 
AP-363 “Extended Flash BIOS Design for Portable Computers” 292098 
ER-28 “ETOX-IIIl Flash Memory Technology” 204012 
ER-29 “The Intel 2/4-Mbit Boot Block Flash Memory Family” 294013 


REVISION HISTORY 


| Number | Description } 


Removed — 70 speed bin 

Integrated — 70 characteristics into — 60 speed bin 

Added Extended Temperature characteristics 

Modified BYTE # Timing Diagram 

Improved tpyaqy, RP # High to Output Delay and tpy_e_, RP # High Recovery to CE # going low 
specifications 


PWD changed to RP # for JEDEC standardization compatibility. 
Combined Vcc Read current for 28F200BX Word-wide mode and Byte-wide mode, and 
28F002BX Byte-wide mode in DC Characteristics tables. 

Change Ipps current spec from +10 wA to +15 pA in DC Characteristics tables. 
Improved Iocr and Iocw in DC Characteristics: Extended Temperature Operation table. 


Improved tavav; tavav; teLav; taLav; teHaz: taHaz; trHav and tF_qz specifications for 
Extended Temperature Operations AC Characteristics—Read and Write Operations. 


ADVANCE INFORMATION | 4-137 


intel. 


~ PRELIMINARY 


28F200BX-TL/BL, 28F002BX-TL/BL 
2-MBIT (128K x 16, 256K x 8) LOW POWER BOOT BLOCK 
FLASH MEMORY FAMILY 


m Low Voltage Operation for Very Low 
Power Portable Applications 
—Vcec = 3.3V +0.3V 


x8/x16 Input/Output Architecture 

— 28F200BX-TL, 28F200BX-BL 

— For High Performance and High 
Integration 16-bit and 32-bit CPUs 


x8-only Input/Output Architecture 

— 28F002BX-TL, 28F002BX-BL ° 

— For Space Constrained 8-bit 
Applications 


Optimized High Density Blocked 
Architecture 

— One 16-KB Protected Boot Block 
— Two 8-KB Parameter Blocks 

— One 96-KB Main Block 

— One 128-KB Main Block 

— Top or Bottom Boot Locations 


Extended Cycling Capability 
— 10,000 Block Erase Cycles 


Automated Word/Byte Write and Block 
Erase 

— Command User Interface 

— Status Registers 

— Erase Suspend Capability 


SRAM-Compatible Write Interface 
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Automatic Power Savings Feature 
— 0.8 mA Typical Icc Active Current in 
Static Operation 


Very High-Performance Read 
— 150 ns Maximum Access Time 
— 65 ns Maximum Output Enable Time 


Low Power Consumption 
— 15 mA Typical Active Read Current 


Reset/Deep Power-Down Input 
— 0.2 vA Icc Typical 
— Acts as Reset for Boot Operations 


Write Protection for Boot Block 


Hardware Data Protection Feature 
— Erase/Write Lockout during Power 
Transitions 


Industry Standard Surface Mount 
Packaging 
— 28F200BX-L: JEDEC ROM Compatible 
44-Lead PSOP 
56-Lead TSOP 
— 28F002BX-L: 40-Lead TSOP 


12V Word/Byte Write and Block Erase 
—Vpp = 12V +5% Standard 


ETOX Ill Flash Technology 
— 3.3V Read 


Independent Software Vendor Support 


October 1993 — 


Order Number: 290449-003 
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Intel’s 2-Mbit Low Power Flash Memory Family is an extension of the Boot Block Architecture which includes 
block-selective erasure, automated write and erase operations and standard microprocessor interface. The 
2-Mbit Flash Memory Family enhances the Boot Block Architecture by adding more density and blocks, 
x8/x16 input/output control, very low power, very high speed, an industry standard ROM compatible pinout 
and surface mount packaging. The 2-Mbit Low Power Flash Family opens a new capability for 3V battery-oper- 
ated portable systems and allows for an easy upgrade to Intel’s 4-Mbit Low Power Boot Block Flash Memory 
Family. 


The Intel 28F200BX-TL/BL are 16-bit wide flash memory offerings. These high density flash memories provide 
user selectable bus operation for either 8-bit or 16-bit applications. The 28F200BX-TL and 28F200BX-BL are 
2,097,152-bit non-volatile memories organized as either 262,144 bytes or 131,072 words of information. They 
are offered in 44-Lead plastic SOP and 56-Lead TSOP packages. The x8/x16 pinout conforms to the industry 
standard ROM/EPROM pinout. 


The Intel 28FO002BX-TL/BL are 8-bit wide flash memories with 2,097,152 bits organized as 262,144 bytes of 
information. They are offered in a 40-Lead TSOP package, which is ideal for space-constrained portable 
systems. 


These devices use an integrated Command User Interface (CUI) and Write State Machine (WSM) for simplified 
word/byte write and block erasure. The 28F200BX-TL/28F002BX-TL provide block locations compatible with 
Intel’s low voltage MCS-186 family, i3886™, i486™ microprocessors. The 28F200BX-BL/28F002BX-BL pro- 
vide compatibility with Intel’s 80960KX and 80960SX families as well as other low voltage embedded micro- 
processors. 


The boot block includes a data protection feature to protect the boot code in critical applications. With a 
maximum access time of 150 ns, these 2-Mbit flash devices are very high performance low power memories 
which interface to a wide range of low power microprocessors and microcontrollers. A deep power-down mode 
lowers the total Voc power consumption to 0.66 pW. This is critical in handheld battery powered systems such 
as Handy Phones. For very high speed applications using a 5V supply, refer to the Intel 28F200BX-T/B, 
28F002BX-T/B 2-Mbit Boot Block Flash Memory Family datasheet. 


Manufactured on Intel’s 0.8 micron ETOX III process, the 2-Mbit low power flash memory family provides world 
class quality, reliability and cost-effectiveness at the 2-Mbit density level. 
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1.0 PRODUCT FAMILY OVERVIEW 


Throughout this datasheet 28F200BX-L refers to 
both the 28F200BX-TL and 28F200BX-BL devices 
and 28F002BX-L refers to both the 28FO002BX-TL 
and 28F002BX-BL devices. The 2-Mbit flash family 
refers to both the 28F200BX-L and 28F002BX-L 
products. This datasheet comprises the specifica- 
tions for four separate products in the 2-Mbit flash 
memory family. Section 1 provides an overview of 
the 2-Mbit flash memory family including applica- 
tions, pinouts and pin descriptions. Sections 2 and 3 
describe in detail the specific memory organizations 
for the 28F200BX-L and 28F002BX-L products re- 
spectively. Section 4 combines a description of the 
family’s principles of operations. Finally, section 5 
describes the family’s operating specifications. 


PRODUCT FAMILY 


x8/x16 Products x8-Only Products 


28F200BX-TL 
28F200BX-BL 


28F002BX-TL 
28F002BX-BL 


1.1 Main Features 


The 28F200BX-L/28F002BX-L low power boot 
block flash memory family is a very low power and 
very high performance 2-Mbit (2,097,152 bit) memo- 
ry family organized as either 128 Kwords (131,072 
words) of 16 bits each or 256 Kbytes (262,144 
bytes) of 8 bits each. 


Five Separately Erasable Blocks including a Hard- 
ware-Lockable boot block (16,384 Bytes), two pa- 
rameter blocks (8,192 Bytes each) and two main 
blocks (1 block of 98,304 Bytes and 1 block of 
131,072 Bytes) are included on the 2-Mbit family. An 
erase operation erases one of the 5 blocks in typi- 
cally 3.4 seconds and the boot or parameter blocks 
in typically 2.0 seconds, independent of the remain- 
ing blocks. Each block can be independently erased 
and programmed 10,000 times. 


The Boot Block is located at either the top 
(28F200BX-TL, 28FO002BX-TL) or the bottom 
(28F200BX-BL, 28FO002BX-BL) of the address map 
in order to accommodate different microprocessor 
protocols for boot code location. The hardware 
lockable boot block provides the most secure code 
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storage. The boot block is intended to store the ker- 
nel code required for booting-up a system. When the 
RP# pin is between 11.4V and 12.6V the boot block 
is unlocked and program and erase operations can 
be performed. When the RP # pin is at or below 4.1V 
the boot block is locked and program and erase op- 
erations to the boot block are ignored. 


The 28F200BX-L products are available in the 
ROM/EPROM compatible pinout and housed in the 
44-Lead PSOP (Plastic Small Outline) package and 
the 56-Lead TSOP (Thin Small Outline, 1.2 mm 
thick) package as shown in Figures 3 and 4. The 
28F002BX-L products are available in the 40-Lead 
TSOP (1.2 mm thick) package as shown in Figure 5. 


The Command User Interface (CUI) serves as the 
interface between the microprocessor or microcon- 
troller and the internal operation of the 28F200BX-L 
and 28F002BX-L flash memory products. 


Program and Erase Automation allow program 
and erase operations to be executed using a two- 
write command sequence to the CUI. The internal 
Write State Machine (WSM) automatically executes 
the algorithms and timings necessary for program 
and erase operations, including verifications, there- 
by unburdening the microprocessor or microcontrol- 
ler. Writing of memory data is performed in word or 
byte increments for the 28F200BX-L family and in 
byte increments for the 28FO002BX-L family typically 
within 11 ps. 


The Status Register (SR) indicates the status of the 
WSM and whether the WSM successfully completed 
the desired program or erase operation. 


Maximum Access Time of 150 ns (Tacc) is 
achieved over the commercial temperature range 
(O°C to +70°C), over Voc supply voltage range 
(3.0V to 3.6V, 4.5V to 5.5V) and 50 pF output load. 


Ipp Program current is 40 mA for x16 operation 
and 30 mA for x8 operation. Ipp Erase current is 
30 mA maximum. Vpp erase and programming 
voltage is 11.4V to 12.6V (Vpp = 12V +5%) un- 
der all operating conditions. 


Typical icc Active Current of 15 mA is achieved 
for the x16 products and the x8 products. 
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The 2-Mbit flash family is also designed with an Au- 
tornatic Power Savings (APS) feature to minimize 
system battery current drain and allow for extremely 
low power designs. Once the device is accessed to 
read the array data, APS mode will immediately put 
the memory in static mode of operation where Icc 
active current is typically 0.8 mA until the next read 
is initiated. 


When the CE# and RP# pins are at Vcc and the 
BYTE# pin (28F200BX-L-only) is at either Voc or 
GND the CMOS Standby mode is enabled where 
Icc is typically 40 pA. 


A Deep Power-down Mode is enabled when the 
RP # pin is at ground minimizing power consumption 
and providing write protection during power-up con- 
ditions. I¢¢ current during deep power-down mode 
is 0.20 yA typical. An initial maximum access time 
or Reset Time of 700 ns is required from RP# 
switching until outputs are valid. Equivalently, the 
device has a maximum wake-up time of 580 ns until 
writes to the Command User Interface are recog- 
nized. When RP # is at ground the WSM is reset, the 
Status Register is cleared and the entire device is 
protected from being written to. This feature pre- 
vents data corruption and protects the code stored 
in the device during system reset. The system Reset 
pin can be tied to RP# to reset the memory to nor- 
mal read mode upon activation of the Reset pin. 
When the CPU enters reset mode, it expects to read 
the contents of a memory location. Furthermore, 
with on-chip program/erase automation in the 
2-Mbit family and the RP # functionality for data pro- 
tection, after the CPU is reset and even if a program 
or erase command is issued, the device will not rec- 
ognize any operation until RP # returns to its normal 
state. 


For the 28F200BX-L, Byte-wide or Word-wide In- 
put/Output Control is possible by controlling the 
BYTE# pin. When the BYTE# pin is at a logic low 
the device is in the byte-wide mode (x8) and data is 
read and written through DQ[0:7]. During the byte- 
wide mode, DQ[8:14] are tri-stated and DQ45/A_ 
becomes the lowest order address pin. When the 
BYTE# pin is at a logic high the device is in the 
word-wide mode (x16) and data is read and written 
through DQ[0:15]. 


1.2 Applications 


The 2-Mbit low power boot block flash memory fami- 
ly combines high density, 3V operation, high per- 
formance, cost-effective flash memories with block- 
ing and hardware protection capabilities. Its flexibility 
and versatility will reduce costs throughout the prod- 
uct life cycle. Flash memory is ideal for Just-In-Time 
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production flow, reducing system inventory and 
costs, and eliminating component handling during 
the production phase. During the product life cycle, 
when code updates or feature enhancements be- 
come necessary, flash memory will reduce the up- 
date costs by allowing either a user-performed code 
change via floppy disk or a remote code change via 
a serial link. The 2-Mbit boot block flash memory 
family provides full function, blocked flash memories 
suitable for a wide range of applications. These ap- 
plications include Extended PC BIOS, Handy Digi- 
tal Cellular Phone program and data storage and 
various other portable embedded applications where 
both program and data storage are required. 


Reprogrammable systems such as Notebook and 
Palmtop computers, are ideal applications for the 
2-Mbit low power flash products. Portable and han- 
dheld personal computer applications are becoming 
more complex with the addition of power manage- 
ment software to take advantage of the latest micro- 
processor technology, the availability of ROM-based 
application software, pen tablet code for electronic 
handwriting, and diagnostic code. Figure 1 shows an 
example of a 28F200BX-TL application. 


This increase in software sophistication augments 
the probability that a code update will be required 
after the PC is shipped. The 2-Mbit low power flash 
memory products provide an inexpensive update so- 
lution for the notebook and handheld personal com- 
puters while extending their product lifetime. Fur- 
thermore, the 2-Mbit flash memory products’ deep 
power-down mode provides added flexibility for 
these battery-operated portable designs which re- 
quire operation at extremely low power levels. 


The 2-Mbit low power flash products also provide 
excellent design solutions for Handy Digital Cellular 
Phone applications requiring high density storage, 
high performance capabilities coupled with low volt- 
age operation, and a small form factor package (x8- 
only bus). The 2-Mbit’s blocking scheme allows for 
an easy segmentation of the embedded code with: 
16 Kbytes of Hardware-Protected Boot code, 2 Main 
Blocks of program code and 2 Parameter Blocks of 
8 Kbytes each for frequently updatable data storage 
and diagnostic messages (e.g., phone numbers, au- 
thorization codes). Figure 2 is an example of such an 
application with the 28FO02BX-TL. 


These are a few actual examples of the wide range 
of applications for the 2-Mbit Low Power Boot Block 
flash memory family which enables system design- 
ers to achieve the best possible product design. 
Only your imagination limits the applicability of such 
a versatile low power product family. 
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82360SL 
Controller 


RESET# 
PWRGOOD 


Sp[0: 14] He DQ-15 
XCEIVER 


SAp-16 


80386SL ROMCSO# 
MEMRD# 


DQ -DQ, Ag-Ay7 


CE* 28F002BX-TL 
8 
Vpp 
GENERATOR 


80L188EB 


UCS# 


SYSTEM RESET 290449-22 


Figure 2. 28F002BX-TL Interface to INTEL 80L188EB, Low Voltage 8-Bit Embedded Microprocessor 
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1.3 Pinouts 


The 28F200BX-L 44-Lead PSOP pinout follows the 
industry standard ROM/EPROM pinout as shown in 
Figure 3 with an upgrade to the 28F400BX-L 
(4-Mbit low power flash family). Furthermore, 
the 28F200BX-L 56-Lead TSOP pinout shown in 


28F400BX-L 
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Figure 4 provides density upgrades to the 
28F400BX-L and to future higher density boot block 
memories. 


The 28F002BX-L 40-Lead TSOP pinout shown in 
Figure 5 is 100% compatible and has a density up- 
grade to the 28FO04BX-L 4-Mbit Low Power Boot 
Block flash memory. 


28F400BX-L 


PA28F200BX-L 


44 LEAD PSOP 
0.525” x 1.110” 
TOP VIEW 


PRELIMINARY 


Figure 3. PSOP Lead Configuration for x8/x16 28F200BX-L 
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28F400BX-L 


O 


OAN DUR WH 


28F200BX-L 
56-LEAD TSOP 
14mm x 20mm 
TOP VIEW 
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28F004BX-L 28F004BX-L 


O 


28FO002BX-L 
40-LEAD TSOP 
10mm x 20mm 
TOP VIEW 


COON OUFAWDH 
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Figure 5. TSOP Lead Configuration for x8 28F002BX-L 
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1.4 Pin Descriptions for x8/x16 28F200BX-L 


| Symbol | Type | Name and Function | 


Ao-Ai6 ADDRESS INPUTS for memory addresses. Addresses are internally latched 
during a write cycle. 


ADDRESS INPUT: When Ag i is at 12V the signature mode is accessed. During this 
mode Ao decodes between the manufacturer and device ID’s. When BYTE # is at 
a logic low only the lower byte of the signatures are read. DQ;5/A_—4 is adon’t 

care in the signature mode when BYTE # is low. 


DATA INPUTS/OUTPUTS: Inputs array data on the second CE# and WE# cycle 
during a program command. Inputs commands to the command user interface 
when CE # and WE # are active. Data is internally latched during the write and 
program cycles. Outputs array, Intelligent Identifier and Status Register data. The 
data pins float to tri-state when the chip is deselected or the outputs are disabled. 


DATA INPUT/OUTPUTS: Inputs array data on the second CE # and WE# cycle 
during a program command. Data is internally latched during the write and program 
cycles. Outputs array data. The data pins float to tri-state when the chip is 
deselected or the outputs are disabled as in the byte-wide mode (BYTE# = “0”). 
In the byte-wide mode DQ15/A_— 4 becomes the lowest order address for data 
output on DQ9-DQz. 


CHIP ENABLE: Activates the device’s control logic, input buffers, decoders and 
sense amplifiers. CE # is active low; CE # high deselects the memory device and 
reduces power consumption to standby levels. If CE # and RP# are high, but not 
at a CMOS high level, the standby current will increase due to current flow through 
the CE# and RP# input stages. 


RESET/DEEP POWER-DOWN: Provides Three-State control. Puts the device in 
deep power-down mode. Locks the boot block from program/erase. 


When FP # is at logic high level and equals 4.1V maximum the boot block is 
locked and cannot be programmed or erased. 


When RP# = 11.4V minimum the boot block is unlocked and can be programmed 
or erased. 


When FP # is at a logic low level the boot block is locked, the deep power-down 
mode is enabled and the WSM is reset preventing any blocks from being 
programmed or erased, therefore providing data protection during power 
transitions. When RP # transitions from logic low to logic high, the flash memory 
enters the read-array mode. 


WRITE ENABLE: Controls writes to the Command Register and array blocks. 
WE # is active low. Addresses and data are latched on the rising edge of the WE # 
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1.4 Pin Descriptions for x8/x16 28F200BX-L (Continued) 


Symbol Name and Function 


BYTE# 2 BYTE # ENABLE: Controls whether the device operates in the byte-wide mode (x8) or 


the word-wide mode (x16). BYTE# = “0” enables the byte-wide mode, where data is 


read and programmed on DQg-DQ7 and DQ;5/A_ 4 becomes the lowest order 
address that decodes between the upper and lower byte. DQg—DQy,, are tri-stated 
during the byte-wide mode. BYTE# = “1” enables the word-wide mode where data is 
read and programmed on DQo-DQ}5. 


PROGRAM/ERASE POWER SUPPLY: For erasing memory array blocks or 
programming data in each block. 


Note: Vpp < Vpp; wax Memory contents cannot be altered. | 


DEVICE POWER SUPPLY (3.3V +0.3V, 5V + 10%) 


GROUND: For all internal circuitry 
NO CONNECT: Pin may be driven or left floating 
DON’T USE PIN: Pin should not be connected to anything 
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ADDRESS INPUTS for memory addresses. Addresses are internally latched during 
a write cycle. 


ADDRESS INPUT: When Ag is at 12V the signature mode is accessed. During this 
mode Ao decodes between the manufacturer and device |D’s. 


DATA INPUTS/OUTPUTS: Inputs array data on the second CE# and WE# cycle 


during a program command. Inputs commands to the command user interface 
when CE # and WE # are active. Data is internally latched during the write and 
program cycles. Outputs array Intelligent Identifier and status register data. The 
data pins float to tri-state when the chip is deselected or the outputs are disabled. 


_CHIP ENABLE: Activates the device’s control logic, input buffers, decoders and 
- sense amplifiers. CE # is active low; CE# high deselects the memory device and 
reduces power consumption to standby levels. 


RESET/DEEP POWER-DOWN: Provides Three-State control. Puts the device in 
deep power-down mode. Locks the Boot Block from program/erase. 

When FP # is at logic high level and equals 4.1V maximum the Boot Block is locked 
and cannot be programmed or erased. 

When RP# = 11.4V minimum the Boot Block is unlocked and can be programmed 
or erased. 

When FP # is at a logic low level the Boot Block is locked, the deep power-down 
mode is enabled and the WSM is reset preventing any blocks from being 
programmed or erased, therefore providing data protection during power 
transitions. When RP # transitions from logic low to logic high, the flash memory 
enters the read-array mode. 


OUTPUT ENABLE: Gates the device’s outputs through the data buffers during a 
read cycle. OE # is active low. 


WRITE ENABLE: Controls writes to the Command Register and array blocks. WE # 
is active low. Addresses and data are latched on the rising edge of the WE # pulse. 
PROGRAM/ERASE POWER SUPPLY: For erasing memory array blocks or 


programming data in each block. 
Note: Vpp < Vppi_max Memory contents cannot be altered. 


I/O 
DEVICE POWER SUPPLY (3.3V +0.3V, 5V + 10%) 
owe GROUND: For all internal circuitry 


NO CONNECT: Pin may be driven or left floating 
DON’T USE PIN: Pin should not be connected to anything 
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2.0 28F200BX-L PRODUCTS DESCRIPTION 
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Figure 6. 28F200BX-L Word/Byte-Wide Block Diagram 
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2.1 28F200BX-L Memory Organization 


2.1.1 BLOCKING 


The 28F200BX-L uses a blocked array architecture 
to provide independent erasure of memory blocks. A 
block is erased independently of other blocks in the 
array when an address is given within the block ad- 
dress range and the Erase Setup and Erase Confirm 
commands are written to the CUI. The 28F200BX-L 
is a random read/write memory, only erasure is per- 
formed by block. 


2.1.1.1 Boot Block Operation and Data 
Protection 


The 16-Kbyte boot block provides a lock feature for 
secure code storage. The intent of the boot block is 
to provide a secure storage area for the kernel code 
that is required to boot a system in the event of pow- 
er failure or other disruption during code update. 
This lock feature ensures absolute data integrity by 
preventing the boot block from being written or 
erased when RP # is not at 12V. The boot block can 
be erased and written when RP # is held at 12V for 
the duration of the erase or program operation. This 
allows customers to change the boot code when 
necessary while providing security when needed. 
See the Block Memory Map section for address lo- 
cations of the boot block for the 28F200BX-TL and 
28F200BX-BL. 


2.1.1.2 Parameter Block Operation 


The 28F200BX-L has 2 parameter blocks (8 Kbytes 
each). The parameter blocks are intended to pro- 
vide storage for frequently updated system parame- 
ters and configuration or diagnostic information. The 
parameter blocks can also be used to store addition- 
al boot or main code. The parameter blocks howev- 
er, do not have the hardware write protection feature 
that the boot block has. The parameter blocks pro- 
vide for more efficient memory utilization when deal- 
ing with parameter changes versus reg-ularly 
blocked devices. See the Block Memory Map sec- 
tion for address locations of the parameter blocks 
for the 28F200BX-TL and 28F200BX-BL. 


' 
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2.1.1.3 Main Block Operation 


Two main blocks of memory exist on the 
28F200BX-L (1 x 128-Kbyte block and 1 x 96-Kbyte 
blocks). See the following section on Block Memory 
Map for the address location of these blocks for the 
28F200BX-TL and 28F200BX-BL products. 


2.1.2 BLOCK MEMORY MAP 


Two versions of the 28F200BX-L product exist to 
support two different memory maps of the array 
blocks in order to accommodate different micropro- 
cessor protocols for boot code location. The 
28F200BX-TL memory map is inverted from the 
28F200BX-BL memory map. 


2.1.2.1 28F200BX-BL Memory Map 


The 28F200BX-BL device has the 16-Kbyte boot 
block located from O0000H to 01FFFH to accom- 
modate those microprocessors that boot from the 
bottom of the address map at OOOOOH. In the 
28F200BX-BL the first 8-Kbyte parameter block re- 
sides in memory space from 02000H to O2FFFH. 
The second 8-Kbyte parameter block resides in 
memory space from O3000H to O3FFFH. The 
96-Kbyte main block resides in memory space from 
04000H to OFFFFH. The 128-Kbyte main block re- 
sides in memory space from 10000H to 1FFFFH 
(word locations). See Figure 7. 


(Word Addresses) 


1FFFFH 


128-Kbyte MAIN BLOCK 


10000H 
OFFFFH 


96-Kbyte MAIN BLOCK 
04000H 
O3FFFH 


03000H 
O2FFFH 


02000H 
01FFFH 


_ 8-Kbyte PARAMETER BLOCK 


8-Kbyte PARAMETER BLOCK 


16-Kbyte BOOT BLOCK 
00000H 


Figure 7. 28F200BX-BL Memory Map 
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2.1.2.2 28F200BX-TL Memory Map 


The 28F200BX-TL device has the 16-Kbyte boot 
block located from 1EQ00H to 1FFFFH to accommo- 
date those microprocessors that boot from the top 
of the address map. In the 28F200BX-TL the first 
8-Kbyte parameter block resides in memory space 
from 1D000H to 1DFFFH. The second 8-Kbyte pa- 
rameter block resides in memory space from 
1COO0H to 1CFFFH. The 96-Kbyte main block re- 
sides in memory space from 10000H to 1BFFFH. 
The 128-Kbyte main block resides in memory space 
from OOO00H to OFFFFH as shown below in Figure 
8. 
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(Word Addresses) 


1FFFFH 


1E000H 
1DFFFH 


1D000H 
1CFFFH 


1C000H 
1BFFFH 


10000H 
OFFFFH 


96-Kbyte MAIN BLOCK 


128-Kbyte MAIN BLOCK 


Figure 8. 28F200BX-TL Memory Map 
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3.0 28F002BX-L PRODUCTS DESCRIPTION 
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Figure 9. 28F002BX-L Byte-Wide Block Diagram 
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3.1 28FO002BX-L Memory Organization 


3.1.1 BLOCKING 


The 28F002BX-L uses a blocked array architecture 
to provide independent erasure of memory blocks. A 
block is erased independently of other blocks in the 
array when an address is given within the block ad- 
dress range and the Erase Setup and Erase Confirm 
commands are written to the CUI. The 28FOO02BX-L 
is a random read/write memory, only erasure is per- 
formed by block. 


3.1.1.1 Boot Block Operation and Data 
Protection 


The 16-Kbyte boot block provides a lock feature for 
secure code storage. The intent of the boot block is 
to provide a secure storage area for the kernel code 
that is required to boot a system in the event of pow- 
er failure or other disruption during code update. 
This lock feature ensures absolute data integrity by 
preventing the boot block from being programmed 
or erased when RP # is not at 12V. The boot block 
can be erased and programmed when RP # is held 
at 12V for the duration of the erase or program oper- 
ation. This allows customers to change the boot 
code when necessary while still providing security 
when needed. See the Block Memory Map section 
for address locations of the boot block for the 
28F002BX-TL and 28F002BX-BL. 


3.1.1.2 Parameter Block Operation 


The 28F002BX-L has 2 parameter blocks (8 Kbytes 
each). The parameter blocks are intended to pro- 
vide storage for frequently updated system parame- 
ters and configuration or diagnostic information. The 
parameter blocks can also be used to store addition- 
al boot or main code. The parameter blocks howev- 
er, do not have the hardware write protection feature 
that the boot block has. Parameter blocks provide 
for more efficient memory utilization when dealing 
with small parameter changes versus regularly 
blocked devices. See the Block Memory Map sec- 
tion for address locations of the parameter blocks 
for the 28FO02BX-TL and 28F002BX-BL. 


3.1.1.3 Main Block Operation 
Two main blocks of memory exist on the 


— 28F002BX-L (1 x 128-Kbyte block and 1 x 96-Kbyte 
block). 
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See the following section on Block Memory Map for 


the address location of these blocks for the 
28F002BX-TL and 28F002BX-BL. 


3.1.2 BLOCK MEMORY MAP 


Two versions of the 28F002BX-L product exist to 
support two different memory maps of the array 
blocks in order to accommodate different microproc- 
essor protocols for boot code location. The 
28F002BX-TL memory map is inverted from the 
28F002BX-BL memory map. 


3.1.2.1 28FO02BX-BL Memory Map 


The 28F002BX-BL device has the 16-Kbyte boot 
block located from OO000H to O3FFFH to accommo- 
date those microprocessors that boot from the bot- 
tom of the address map at OOOOOH. In the 
28F002BX-BL the first 8-Kbyte parameter block re- 
sides in memory from 04000H to O5FFFH. The sec- 
ond 8-Kbyte parameter block resides in memory 
space from O6000H to O7FFFH. The 96-Kbyte main 
block resides in memory space from O8000H to 
1FFFFH. The 128-Kbyte main block resides in mem- 
ory space from 20000H to 3FFFFH. See Figure 10. 


3FFFFH 


128-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


96-Kbyte MAIN BLOCK 
08000H 
O7FFFH 


06000H 
OSFFFH 


04000H 
O3FFFH 


8-Kbyte PARAMETER BLOCK 


8-Kbyte PARAMETER BLOCK 


16-Kbyte BOOT BLOCK 
00000H 


Figure 10. 28FO002BX-BL Memory Map 
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3.1.2.2 28F002BX-TL Memory Map 


The 28F002BX-TL device has the 16-Kbyte boot 
block located trom 3CO0O0H to 3FFFFH to accom- 
modate those microprocessors that boot from the 
top of the address map. In the 28F002BX-TL the first 
8-Kbyte parameter block resides in memory space 
from 3A000H to 3BFFFH. The second 8-Kbyte pa- 
rameter block resides in memory space from 
38000H to 39FFFH. The 96-Kbyte main block re- 
sides in memory space from 20000H to 37FFFH. 
The 128-Kbyte main block resides in memory space 
from OOOOOH to 1FFFFH. 


3FFFFH 


16-Kbyte BOOT BLOCK 


3C000H 
3BFFFH 


3A000H 
39FFFH 


38000H 
37FFFH 


96-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128-Kbyte MAIN BLOCK 


00000H 


Figure 11. 28F002BX-TL Memory Map 


4.0 PRODUCT FAMILY PRINCIPLES 
OF OPERATION 


Flash memory augments EPROM functionality with 
in-circuit electrical write and erase. The 2-Mbit flash 
family utilizes a Command User Interface (CUI) and 
internally generated and timed algorithms to simplify 
write and erase operations. 
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The CUI allows for fixed power supplies during era- 
sure and programming, and maximum EPROM com- 
patibility. 


In the absence of high voltage on the Vpp pin, the 
2-Mbit flash family will only successfully execute the 
following commands: Read Array, Read Status Reg- 
ister, Clear Status Register and Intelligent Identifier 
mode. The device provides standard EPROM read, 
standby and output disable operations. Manufactur- 
er Identification and Device Identification data can 
be accessed through the CUI or through the stan- 
dard EPROM AQ high voltage access (Vip) (for 
PROM programmer equipment). 


The same EPROM read, standby and output disable 
functions are available when high voltage is applied 
to the Vpp pin. In addition, high voltage on Vpp al- 
lows write and erase of the device. All functions as- 
sociated with altering memory contents: write and 
erase, Intelligent Identifier read and Read Status are 
accessed via the CUI. 


The purpose of the Write State Machine (WSM) is to 
completely automate the write and erasure of the 
device. The WSM will begin operation upon receipt 
of a signal from the CUI and will report status back 
through a Status Register. The CUI will handle the 
WE # interface to the data and address latches, as 
well as system software requests for status while the 
WSM is in operation. 


4.1 28F200BX-L Bus Operations 


Flash memory reads, erases and writes in-system 
via the local CPU. All bus cycles to or from the flash 
memory conform to standard microprocessor bus 
cycles. 
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Table 1. Bus Operations for WORD-WIDE Mode (BYTE# = Vix) 


spp Spe She eee 2278 
2275H 
(678 | Va | Mw | vn | Ww | x | x | x 


Table 2. Bus Operations for BYTE-WIDE Mode (BYTE # = Vj) 


[wed | Notes [ne | cee | 0+ | wer | Ae | Ao | Ar] Ver | Bor | DQs-1a 
Fouipatowabio | | vw | vu | vm | vm | xx | x | x | vigh2 | Hignz 
So ARIS HA 
Dewpromesom [of wu [x fox [x [x fe [x | x [one [ne 


Intelligent Identifier zs VIL Vin | Vind Vir 89H tah Z 
(Mfr) 

Intelligent Identifier VIL Vin | Vio | Vin 74H High Z 
See er aS 75H 


pai or ds ahehehebe thee x | x | Ow | HighZ 


NOTES: 

1. Refer to DC Characteristics. 

2. X can be Vi, or Vip for control pins and addresses, Vpp, or Vppy for Vpp. 

3. See DC characteristics for Vpp_, VppH, VHH, Vip voltages. 

4. Manufacturer and Device codes may also be accessed via a CPU write sequence. Ay-Ayg = Vi. 
5. Device ID = 2274H for 28F200BX-TL and 2275H for 28F200BX-BL. 

6. Refer to Table 4 for valid Dixy during a write operation. 
7 
8 
9 
1 


. Command writes for Block Erase or Word/Byte Write are only executed when Vpp = ai. 
. To write or erase the boot block, hold RP# at Vyp. 

. RP# must be at GND +0.2V to meet the 1.2 wA maximum deep power-down current. 

0. The device ID codes are identical to those of the 28F2100BX 5V versions. 
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Table 3. Bus Operations 


NOTES: 
1. Refer to DC Characteristics. 


Ea 
it oa 
acc 

Cee 

RNY 


Intelligent Identifier (Device) 4,5 “a VIL we Me 


pwite 8 | Mw | Mu | vw | Me | xX | x | x | OW 


renee | me | te ee 
| Mu | vm | x | x | Xx | Pour 
vie [ve fx [x |x| Hon 
it ae 

pe 


x | x | x | Highz 
Mu | vw | Vio | Yu | X | 29H 


_ x | x | x | x | Highz 
Piel ove 
7DH 


. X can be Vi, or Viy for control pins and addresses, Vpp. or Vppy for Vpp. 


. See DC characteristics for Vpp_, VppH, VHH, Vip voltages. 


. Manufacturer and Device codes may also be accessed via a CUI write sequence. A,-Aj7 = Vi. 
. Device ID = 7CH for 28FO02BX-TL and 7DH for 28F002BX-BL. 


. Command writes for Block erase or byte program are only executed when Vpp = Vppy. 


. Program or erase the Boot block by holding RP# at Vyp. 


. RP# must be at GND +0.2V to meet the 1.2 »A maximum deep power-down current. 
0. The device ID codes are identical to those of the 28FO02BX 5V versions. 


2 
3 
4 
5 
6. Refer to Table 4 for valid Diy during a write operation. 
i 
8 
9 
1 


4.3 Read Operations 


The 2-Mbit flash family has three user read modes; 
Array, Intelligent Identifier, and Status Register. 
Status Register read mode will be discussed in detail 
in the ‘Write Operations” section. 


During power-up conditions (Vcc supply ramping), it 
takes a maximum of 700 ns from Vcc at 3.0V mini- 
mum to obtain valid data on the outputs. 


4.3.1 READ ARRAY 


If the memory is not in the Read Array mode, it is 
necessary to write the appropriate read mode com- 
mand to the CUI. The 2-Mbit flash family has three 
control functions, all of which must be logically ac- 
tive, to obtain data at the outputs. Chip-Enable CE # 
is the device selection control. Power-Down RP # is 
the device power control. Output-Enable OE # is the 
DATA INPUT/OUTPUT (DQ[0:15] or DQ[0:7]) direc- 
tion control and when active is used to drive data 
from the selected memory on to the I/O bus. 


4.3.1.1 Output Control 


With OE # at logic-high level (Vj), the output from 
the device is disabled and data input/output pins 
(DQ[0:15] or DQ[0:7]) are tri-stated. Data input is 
then controlled by WE#. 


: PRELIMINARY 


4.3.1.2 Input Control 


With WE# at logic-high level (Vj), input to the de- 
vice is disabled. Data Input/Output pins (DQ[0:15] 
or DQ[0:7]) are controlled by OE#. 


4.3.2 INTELLIGENT IDENTIFIERS 


28F200BX-L Products 


The manufacturer and device codes are read via the 
CUI or by taking the Ag pin to 12V. Writing 90H to 
the CUI places the device into Intelligent Identifier 
read mode. A read of location O0000H outputs the 
manufacturer’s identification code, 0O089H, and loca- 
tion 00001H outputs the device code; 2274H for 
28F200BX-TL, 2275H for 28F200BX-BL. When 
BYTE# is at a logic low only the lower byte of the 
above signatures is read and DQ;5/A_, is a “don’t 
care”’ during Intelligent Identifier mode. A read array 
command must be written to the CUI to return to the 
read array mode. 
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28F002BX-L Products 


The manufacturer and device codes are also read 
via the CUI or by taking the Ag pin to 12V. Writing 
90H to the CUI places the device into Intelligent 
Identifier read mode. A read of location 00000H 
outputs the manufacturer’s identification code, 89H, 
and location 00001H outputs the device code; 7CH 
for 28FO02BX-TL, 7DH for 28FO02BX-BL. 


4.4 Write Operations 


Commands are written to the CUI using standard mi- 
croprocessor write timings. The CUI serves as the 
interface between the microprocessor and the inter- 
nal chip operation. The CUI can decipher Read Ar- 
ray, Read Intelligent Identifier, Read Status Register, 
Clear Status Register, Erase and Program com- 
mands. In the event of a read command, the CUI 
simply points the read path at either the array, the 
Intelligent Identifier, or the status register depending 
on the specific read command given. For a program 
or erase cycle, the CU! informs the write state ma- 
chine that a write or erase has been requested. Dur- 
ing a program cycle, the Write State Machine will 
control the program sequences and the CUI will only 
respond to status reads. During an erase cycle, the 
CUI will respond to status reads and erase suspend. 
After the Write State Machine has completed its 
task, it will allow the CUI to respond to its full com- 
mand set. The CUI will stay in the current command 
state until the microprocessor issues another com- 
mand. 


The CUI will successfully initiate an erase or write 
operation only when Vpp is within its voltage range. 
Depending upon the application, the system design- 
er may choose to make the Vpp power supply 
switchable, available only when memory updates 
are desired. The system designer can also choose 
to “hard-wire” Vpp to 12V. The 2-Mbit flash family is 
designed to accommodate either design practice. It 
is recommended that RP# be tied to logical Reset 
for data protection during unstable CPU reset func- 
tion as described in the “Product Family Overview’ 
section. 
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4.4.1 BOOT BLOCK WRITE OPERATIONS 


In the case of Boot Block modifications (write and 
erase), RP# is set to Vu = 12V typically, in addi- 
tion to Vpp at high voltage. However, if RP # is not at 
VuH when a program or erase operation of the boot 
block is attempted, the corresponding status register 
bit (Bit 4 for Program and Bit 5 for Erase, refer to 
Table 5 for Status Register Definitions) is set to indi- 
cate the failure to complete the operation. 


4.4.2 COMMAND USER INTERFACE (CUI) 


The Command User Interface (CUI) serves as the 
interface to the microprocessor. The CUI points the 
read/write path to the appropriate circuit block as 
described in the previous section. After the WSM 
has completed its task, it will set the WSM Status bit 
to a “1”, which will also allow the CUI to respond to 
its full command set. Note that after the WSM has 
returned control to the CUI, the CUI will remain in its 
current state. 


4.4.2.1 Command Set 


Command Device Mode 
Codes 


Invalid/Reserved 

Alternate Program Setup 
Erase Setup 

Program Setup 

Clear Status Register 

Read Status Register 
Intelligent Identifier 

Erase Suspend 

Erase Resume/Erase Confirm 
Read Array 


4.4.2.2 Command Function Descriptions 


Device operations are selected by writing specific 
commands into the CUI. Table 4 defines the 2-Mbit 
flash family commands. 
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Table 4. Command Definitions 


Operation 
; 
Write 
Write 
X 
X 


Alternate Word/Byte Write 
Setup/Write 


NOTES: 
1. Bus operations are defined in Tables 1, 2, 3. 
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2. |A = Identifier Address: OOH for manufacturer code, 01H for device code. 


3. SRD = Data read from Status Register. 
4. ID = Intelligent Identifier Data. 


- Following the Intelligent Identifier Command, two read operations access manufacturer and device codes. 


5. BA = Address within the block being erased. 
6. WA = Address to be written. 

WD = Data to be written at location WA. 

7. Either 40H or 10H commands is valid. 


8. When writing commands to the device, the upper data bus [DQg-DQ 5] = X (28F200BX-L-only) which is either Voc or 


Vss to avoid burning additional current. 


Invalid/Reserved 


These are unassigned commands. It is not recom- 
mended that the customer use any command other 
than the valid commands specified above. Intel re- 
serves the right to redefine these codes for future 
functions. 


Read Array (FFH) 


This single write command points the read path at 
the array. If the host CPU performs a CE#/OE# 
controlled read immediately following a two-write se- 
quence that started the WSM, then the device will 
output status register contents. If the Read Array 
command is given after Erase Setup the device is 
reset to read the array. A two Read Array command 
sequence (FFH) is required to reset to Read Array 
after Program Setup. 


Intelligent Identifier (90H) 


After this command is executed, the CUI points the 
output path to the Intelligent Identifier circuits. Only 
Intelligent Identifier values at addresses 0 and 1 can 
be read (only address AO is used in this mode, all 
other address inputs are ignored). 
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Read Status Register (70H) 


This is one of the two commands that is executable 
while the state machine is operating. After this com- 
mand is written, a read of the device will output the 
contents of the status register, regardless of the ad- 
dress presented to the device. 


The device automatically enters this mode after pro- 
gram or erase has completed. 


Clear Status Register (50H) 


The WSM can only set the Program Status and 
Erase Status bits in the status register, it can not 
clear them. Two reasons exist for operating the 
status register in this fashion. The first is a synchro- 
nization. The WSM does not know when the host 
CPU has read the status register, therefore it would 
not know when to clear the status bits. Secondly, if 
the CPU is programming a string of bytes, it may be 
more efficient to query the status register after pro- 
gramming the string. Thus, if any errors exist while 
programming the string, the status register will return 
the accumulated error status. 
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Program Setup (40H or 10H) 


This command simply sets the CUI into a state such 
that the next write will load the address and data 
registers. Either 40H or 10H can be used for Pro- 
gram Setup. Both commands are included to ac- 
commodate efforts to achieve an industry standard 
command code set. 


Program 


The second write after the program setup command, 
will latch addresses and data. Also, the CUI initiates 
the WSM to begin execution of the program algo- 
rithm. While the WSM finishes the algorithm, the de- 
vice will output Status Register contents. Note that 
the WSM cannot be suspended during program- 
ming. 


Erase Setup (20H) 


Prepares the CUI for the Erase Confirm command. 
No other action is taken. If the next command is not 
an Erase Confirm command then the CUI will set 
both the Program Status and Erase Status bits of the 
Status Register to a “1”, place the device into the 
Read Status Register state, and wait for another 
command. 


Erase Confirm (DOH) 


lf the previous command was an Erase Setup com- 
mand, then the CUI will enable the WSM to erase, at 
the same time closing the address and data latches, 
and respond only to the Read Status Register and 
Erase Suspend commands. While the WSM is exe- 
cuting, the device will output Status Register data 
when OE # is toggled low. Status Register data can 
only be updated by toggling either OE # or CE# low. 


Erase Suspend (BOH) 


This command only has meaning while the WSM is 
executing an Erase operation, and therefore will only 
be responded to during an erase operation. After 
this command has been executed, the CUI will initi- 
ate the WSM to suspend Erase operations, and then 
return to responding to only Read Status Register or 
to the Erase Resume commands. Once the WSM 
has reached the Suspend state, it will set an output 
into the CUI which allows the CUI to respond to the 
Read Array, Read Status Register, and Erase Re- 
sume commands. In this mode, the CUI will not re- 
spond to any other commands. The WSM will also 
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set the WSM Status bit to a “1”. The WSM will con- 
tinue to run, idling in the SUSPEND state, regardless 
of the state of all input control pins, with the exclu- 


sion of RP#. RP# low will immediately shut down 
the WSM and the remainder of the chip. 


Erase Resume (DOH) 


This command will cause the CUI to clear the Sus- 
pend state and set the WSM Status bit to a ‘0’, but 
only if an Erase Suspend command was previously 
issued. Erase Resume will not have any effect in all 
other conditions. 


4.4.3 STATUS REGISTER 


The 2-Mbit flash family contains a status register 
which, may be read to determine when a program or 
erase operation is complete, and whether that oper- 
ation completed successfully. The status register 
may be read at any time by writing the Read Status 
command to the CUI. After writing this command, all 
subsequent Read operations output data from the 
status register until another command is written to 
the CUI. A Read Array command must be written to 
the CUI to return to the Read Array mode. 


The status register bits are output on DQ[0:7] 
whether the device is in the byte-wide (x8) or word- 
wide (x16) mode for the 28F200BX-L. In the word- 
wide mode the upper byte, DQ[8:15] is set to OOH 
during a Read Status command. In the byte-wide 
mode, DQ[8:14] are tri-stated and DQ15/A_, re- 
tains the low order address function. 


It should be noted that the contents of the status 
register are latched on the falling edge of OE# or 
CE# whichever occurs last in the read cycle. This 
prevents possible bus errors which might occur if the 
contents of the status register change while reading 
the status register. CE# or OE# must be toggled 
with each subsequent status read, or the completion 
of a program or erase operation will not be evident. 


The Status Register is the interface between the mi- 
croprocessor and the Write State Machine (WSM). 
When the WSM is active, this register will indicate 
the status of the WSM, and will also hold the bits 
indicating whether or not the WSM was successful in 
performing the desired operation. The WSM sets 
status bits “Three” through “Seven” and clears bits 
“Six” and “Seven”, but cannot clear status bits 
“Three” through “Five”. These bits can only be 
cleared by the controlling CPU through the use of 
the Clear Status Register command. 
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Table 5. Status Register Definitions 


SR.7 = WRITE STATE MACHINE STATUS 
1 = Ready 
0 = Busy 

SR ERASE SUSPEND STATUS 


6 = 
1 = Erase Suspended 
0 = Erase in Progress/Completed 


.5 = ERASE STATUS 
1 = Error in Block Erasure 
0 = Successful Block Erase 


.4 = PROGRAM STATUS 
1 = Error in Byte/Word Program 
0 = Successful Byte/Word Program 


SR.3 = Vpp STATUS | 
1 = Vpp Low Detect; Operation Abort 
O = Vpp OK 


4.4.3.2 Clearing the Status Register 


Certain bits in the status register are set by the write 
state machine, and can only be reset by the system 
software. These bits can indicate various failure con- 
ditions. By allowing the system software to control 
the resetting of these bits, several operations may 
be performed (such as cumulatively programming 
several bytes or erasing multiple blocks in se- 
quence). The status register may then be read to 
determine if an error occurred during that program- 
ming or erasure series. This adds flexibility to the 
way the device may be programmed or erased. To 
clear the status register, the Clear Status Register 
command is written to the CUI. Then, any other com- 
mand may be issued to the CUI. Note again that 
before a read cycle can be initiated, a Read Array 
command must be written to the CUI to specify 
whether the read data is to come from the array, 
status register, or Intelligent Identifier. 
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SR.2-SR.0 = RESERVED FOR FUTURE ENHANCEMENTS 
These bits are reserved for future use and should be masked out when polling the Status Register. 


NOTES: 


Write State Machine Status bit must first be checked to 
determine byte/word program or block erase completion, - 
before the Program or Erase Status bits are checked for 
SUCCESS. 


When Erase Suspend is issued, WSM halts execution 
and sets both WSMS and ESS bits to ‘1’. ESS bit re- 
mains set to “1” until an Erase Resume command is is- 
sued. 


When this bit is set to “1”. WSM has applied the maxi- 
mum number of erase pulses to the block and is still un- 
able to successfully perform an erase verify. 


When this bit is set to “1”, WSM has attempted but failed 
to Program a byte or word. 


The Vpp Status bit unlike an A/D converter, does not 
provide continuous indication of Vpp level. The WSM in- 
terrogates the Vpp level only after the byte write or block 
erase command sequences have been entered and in- 
forms the system if Vpp has not been switched on. The 
Vpp Status bit is not guaranteed to report accurate feed- 
back between Vpp, and Vppy. 


4.4.4 PROGRAM MODE 


Program is executed by a two-write sequence. The 
Program Setup command is written to the CUI fol- 
lowed by a second write which specifies the address 
and. data to be programmed. The write state ma- 
chine will execute a sequence of internally timed 
events to: 


1. program the desired bits of the addressed memo- 
ry word (byte), and 


2. verify that the desired bits are sufficiently pro- 
grammed. 


Programming of the memory results in specific bits 
within a byte or word being changed to a “0”. 


If the user attempts to program ‘‘1’’s, there will be no 
change of the memory cell content and no error oc- 
curs. 


- . 
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Similar to erasure, the status register indicates 
whether programming is complete. While the pro- 
gram sequence is executing, bit 7 of the status regis- 
ter is a “O’. The status register can be polled by 
toggling either CE# or OE# to determine when the 
program sequence is complete. Only the Read 
Status Register command is valid while program- 
ming is active. 


When programming is complete, the status bits, 
which indicate whether the program operation was 
successful, should be checked. If the programming 
_ operation was unsuccessful, Bit 4 of the status regis- 
ter is set to a “1” to indicate a Program Failure. If 
Bit 3 is set then Vpp was not within acceptable limits, 
and the WSM will not execute the programming se- 
quence. 


The status register should be cleared before at- 
tempting the next operation. Any CUI instruction can 
follow after programming is completed; however, it 
must be recognized that reads from the memory, 
status register, or Intelligent Identifier cannot be ac- 
complished until the CUI is given the appropriate 
command. A Read Array command must first be giv- 
en before memory contents can be read. 


Figure 12 shows a system software flowchart for de- 
vice byte programming operation. Figure 13 shows a 
similar flowchart for device word programming oper- 
ation (28F200BX-L-only). 


4.4.5 ERASE MODE 


Erasure of a single block is initiated by writing the 
Erase Setup and Erase Confirm commands to the 
CUI, along with the addresses, A[12:16] for the 
28F200BX-L or A[12:17] for the 28FO02BX-L, identi- 
fying the block to be erased. These addresses are 
latched internally when the Erase Confirm command 
is issued. Block erasure results in all bits within the 
block being set to “1”. 


The WSM will execute a sequence of internally 
timed events to: 


1. program all bits within the block 


2. verify that all bits within the block are sufficiently 
programmed 


3. erase all bits within the block and 


4. verify that all bits within the block are sufficiently 
erased 


While the erase sequence is executing, Bit 7 of the 
status register is a “O”’. 


When the status register indicates that erasure is 


complete, the status bits, which indicate whether the 
erase operation was successful, should be checked. 
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If the erasure operation was unsuccessful, Bit 5 of 
the status register is set to a “1” to indicate an 
Erase Failure. If Vpp was not within acceptable limits 
after the Erase Confirm command is issued, the 
WSM will not execute an erase sequence; instead, 
Bit 5 of the status register is set to a “1” to indicate 
an Erase Failure, and Bit 3 is set to a “1” to identify 


that Vpp supply voltage was not within acceptable 
limits. 


The status register should be cleared before at- 
tempting the next operation. Any CUI instruction can 
follow after erasure is completed; however, it must 
be recognized that reads from the memory array, 
status register, or Intelligent Identifier can not be ac- 
complished until the CUI is givén the appropriate 
command. A Read Array command must first be giv- 
en before memory contents can be read. 


Figure 14 shows a system software flowchart for 
Block Erase operation. 


4.4.5.1 Suspending and Resuming Erase 


Since an erase operation typically requires 2 to 5 
seconds to complete, an Erase Suspend command 
is provided. This allows erase-sequence interruption 
in order to read data from another block of the mem- 
ory. Once the erase sequence is started, writing the 
Erase Suspend command to the CUI requests that 
the Write State Machine (WSM) pause the erase se- 
quence at a predetermined point in the erase algo- 
rithm. The status register must be read to determine 
when the erase operation has been suspended. 


At this point, a Read Array command can be written 


~ to the CUI in order to read data from blocks other 


than that which is being suspended. The only other 


-valid command at this time is the Erase Resume 


command or Read Status Register operation. 


Figure 15 shows a system software flowchart detail- 
ing the operation. 


During Erase Suspend mode, the chip can go into a 
pseudo-standby mode by taking CE # to Vi and the 
active current is now a maximum of 6 mA. If the chip 
is enabled while in this mode by taking CE# to Vj, 
the Erase Resume command can be issued to re- 
sume the erase operation. 


Upon completion of reads from any block other than 
the block being erased, the Erase Resume com- 
mand must be issued. When the Erase Resume 
command is given, the WSM will continue with the 
erase sequence and complete erasing the block. As 
with the end of erase, the status register must be 
read, cleared, and the next instruction issued in or- 
der to continue. 
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4.4.66 EXTENDED CYCLING 


Intel has designed extended cycling capability into 
its ETOX Ill flash memory technology. The 2-Mbit 
low voltage flash family is designed for 10,000 pro- 


Write 40H, 
Byte Address 


Write Byte ' 
Address/Data 


Read Status 
Register 


YES 


Full Status 
Check If Desired 
Byte Program 
Completed 


Full Status Check Procedure 


Status Register Data 
Read (See Above) 


290449-8 


Vpp Range 
Error 
Byte Program 
Error 


YES 
Byte Program 
Successful 
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gram/erase cycles on each of the five blocks. The 
combination of low electric fields, clean oxide pro- 
cessing and minimized oxide area per memory cell 
subjected to the tunneling electric field, results in 
very high cycling capability. 


ass Command Comments 
Operation 


Data = 40H 


Address = Byte to be 
programmed 


Write Setup 
Program 


Program Data to be programmed 
Address = Byte to be 


programmed 


Status Register Data. 
Toggle OE # or CE# to update 
Status Register 


Check SR.7 
1 = Ready, 0 = Busy 


Standby 


Repeat for subsequent bytes. 


Full status check can be done after each byte or after a 
sequence of bytes. 


Write FFH after the last byte programming operation to 
reset the device to Read Array Mode. 


Bus 


Check SR.3 
1 = Vpp Low Detect 


Standby 


Check SR.4 
1 = Byte Program Error 


Standby 


SR.3 MUST be cleared, if set during a program attempt, 
before further attempts are allowed by the Write State 
Machine. 


SR.4 is only cleared by the Clear Status Register 
Command, in cases where multiple bytes are programmed 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 12. Automated Byte Programming Flowchart 
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nae Command Comments 
Operation 
Write 40H, Setup Data = 40H 
Word Address Program Address = Word to be 


programmed 


Write Word Program Data to be programmed 
Address/Data Address = Word to be 


programmed 


Read Status Status Register Data. 
Register Toggle OE # or CE # to update 
Status Register 
Check SR.7 


Standby 
1 = Ready, 0 = Busy 


Repeat for subsequent words. 


Full status check can be done after each word or after a 
sequence of words. 


Write FFH after the last word programming operation to 
290449-10 reset the device to Read Array Mode. 


Full Status Check Procedure 
aoe Command Comments 
Operation 


Standby Check SR.3 
1 = Vpp Low Detect 


Standby Check SR.4 
1 = Word Program Error 


TES 
SR.3 MUST be cleared, if set during a program attempt, 
Word Program before further attempts are allowed by the Write State 
Successful Machine. 


290449-11 
SR.4 is only cleared by the Clear Status Register 


Command, in cases where multiple words are programmed 
before full status is checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 13. Automated Word Programming Flowchart 
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ime Command Comments 
Operation 


Data = 20H 
Address = Within block to be 
erased 


Data = DOH 
Address = Within block to be 
erased 


Status Register Data. 
Toggle OE # or CE # to update 
Status Register 


Suspend Erase 
Loop 


Standby Check SR.7 
1 = Ready, 0 = Busy 


Repeat for subsequent blocks. 


Full status check can be done after each block or after a 
sequence of blocks. 


Write FFH after the last block erase operation to reset the 
device to Read Array Mode. 
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Full Status Check Procedure 


ae Command Comments 
Operation 


1 = Vpp Low Detect 


Cc ds 


Both 1 = Command Sequence 
Error 


1 = Block Erase Error 


YES 
SR.3 MUST be cleared, if set during an erase attempt, 
Sussceastal before further attempts are allowed by the Write State 
Machine. 
290449-13 


SR.5 is only cleared by the Clear Status Register 
Command, in cases where multiple blocks are erased 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 14. Automated Block Erase Flowchart 
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Write BOH 


Read Status 
Register 


aul 


Ot 


Erase Has 
Completed 


~< 
m 
” 


Write FFH 


“al 


~< 
m 
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Write DOH 


Continue Erase 
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wiete Command Comments | 
Operation 


Erase Data = BOH 
Suspend 


Status Register Data. 
Toggle OE # or CE# to 
update Status Register 


Check SR.7 


Standby 
1 = Ready 


Check SR.6 
1 = Suspended 


Standby 


Read Array Data = FFH 


Read array data from block 
other than that being 
erased. 


Erase Resume | Data = DOH 


Figure 15. Erase Suspend/Resume Flowchart 


4.5 Power Consumption 


4.5.1 ACTIVE POWER 


With CE# at a logic-low level and RP# at a logic- 
high level, the device is placed in the active mode. 
The device Ico current is a maximum of 22 mA at 
5 MHz. 


4.5.2 AUTOMATIC POWER SAVINGS 


Automatic Power Savings (APS) is a low power fea- 
ture during active mode of operation. The 2-Mbit 
flash family of products incorporate Power Reduc- 
tion Control (PRC) circuitry which basically allows 
the device to put itself into a low current state when 
it is not being accessed. After data is read from the 
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memory array, PRC logic controls the device’s pow- 
er consumption by entering the APS mode where 
typical Icc current is 0.8 mA and maximum Icc cur- 
rent is 2 mA. The device stays in this static state with 
outputs valid until a new memory location is read. 


4.5.3 STANDBY POWER 


With CE # at a logic-high level (Vj), and the CUI in 
read mode, the memory is placed in standby mode 
where the maximum Icc standby current is 120 yA 
with CMOS input signals. The standby operation dis- 
ables much of the device’s circuitry and substantially 
reduces device power consumption. The outputs 
(DQ[0:15] or DQ[0:7]) are placed in a high-imped- 
ance state independent of the status of the OE# 
signal. When the 2-Mbit flash family is deselected 
during erase or program functions, the devices will 


PRELIMINARY 


: 
intel. 
continue to perform the erase or program function 


and consume program or erase active power until 
program or erase is completed. 


4.5.4 RESET/DEEP POWER-DOWN 


The 2-Mbit flash family supports a typical Icc of 
0.2 nA in deep power-down mode. One of the target 
markets for these devices is in portable equipment 
where the power consumption of the machine is of 
prime importance. The 2-Mbit flash family has a 
RP # pin which places the device in the deep power- 
down mode. When RP# is at a logic-low (GND 
+0.2V), all circuits are turned off and the device typ- 
ically draws 0.2 pA of Voc current. 


During read modes, the RP# pin going low dese- 
lects the memory and places the output drivers ina 
high impedance state. Recovery from the deep pow- 
er-down state, requires a minimum of 700 ns to ac- 
cess valid data (tpyay). 


During erase or program modes, RP # low will abort 
either erase or program operation. The contents of 
the memory are no longer valid as the data has been 
corrupted by the RP# function. As in the read mode 
above, all internal circuitry is turned off to achieve 
the 0.2 »A current level. 


RP# transitions to Vj, or turning power off to the 
device will clear the status register. 


The use of RP# during system reset is important 
with automated write/erase devices. When the sys- 
tem comes out of reset, it expects to read from the 
flash memory. Automated flash memories provide 
status information when accessed during write/ 
erase modes. If a CPU reset occurs with no flash 
memory reset, proper CPU initialization would not 
occur because the flash memory would be providing 
the status information instead of array data. Intel’s 
Flash Memories allow proper CPU initialization fol- 
lowing a system reset through the use of RP # input. 
In this application, RP# is controlled by the same 
RESET # signal that resets the system CPU. 


4.6 Power-Up Operation 


The 2-Mbit flash family is designed to offer protec- 
tion against accidental block erasure or program- 
ming during power transitions. Upon power-up the 
2-Mbit flash family is indifferent as to which power 
supply, Vpp or Vcc, powers-up first. Power supply 
sequencing is not required. 


The 2-Mbit flash family ensures the CUI is reset to 
the read mode on power-up. 


In addition, on power-up the user must either drop 
CE# low or present a new address to ensure valid 
data at the outputs. 
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A system designer must guard against spurious 
writes for Vcc voltages above Vixo when Vpp is 
active. Since both WE# and CE# must be low for a 
command write, driving either signal to Vjy will inhibit 


_ writes to the device. The CUI architecture provides 


an added level of protection since alteration of mem- 
ory contents can only occur after successful com- 
pletion of the two-step command sequences. Finally 
the device is disabled until RP# is brought to Vip, 
regardless of the state of its control inputs. This fea- 
ture provides yet another level of memory protec- 
tion. 


4.7 Power Supply Decoupling 


Flash memory’s power switching characteristics re- 
quire careful device decoupling methods. System 
designers are interested in 3 supply current issues: 


e Standby current levels (Icocs) 
e Active current levels (Iccr) 


e Transient peaks produced by falling and rising 
edges of CE#. 


Transient current magnitudes depend on the device 
outputs’ capacitive and inductive loading. Two-line 
control and proper decoupling capacitor selection 
will suppress these transient voltage peaks. Each 
flash device should have a 0.1 wF ceramic capacitor 
connected between each Vcc and GND, and be- 
tween its Vpp and GND. These high frequency, low- 
inherent inductance capacitors should be placed as 
close as possible to the package leads. 


4.7.1 Vpp TRACE ON PRINTED CIRCUIT 
BOARDS \ 


Writing to flash memories while they reside in the 
target system, requires special consideration of the 
Vpp power supply trace by the printed circuit board 
designer. The Vpp pin supplies the flash memory 
cell’s current for programming and erasing. One 
should use similar trace widths and layout consider- 
ations given to the Vcc power supply trace. Ade- 
quate Vpp supply traces and decoupling will de- 
crease spikes and overshoots. 


4.7.2 Vcc, Vpp AND RP# TRANSITIONS 


The CUI latches commands as issued by system 
software and is not altered by Vpp or CE# tran- 
sitions or WSM actions. Its state upon power-up, af- 
ter exit from deep power-down mode or after Vcc 
transitions below Vi Ko (Lockout voltage), is Read 
Array mode. 


After any word/byte write or block erase operation is 
complete and even after Vpp transitions down to 
Vpp_, the CUI must be reset to Read Array mode via 
the Read Array command when accesses to the 
flash memory are desired. 
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5.0 OPERATING SPECIFICATIONS NOTICE: This data sheet contains preliminary infor- 
mation on new products in production. The specifica- 
tions are subject to change without notice. Verify with 
your local Intel Sales office that you have the latest 


data sheet before finalizing a design. 


* WARNING: Stressing the device beyond the “Absolute 
Maximum Ratings” may cause permanent damage. 
These are stress ratings only. Operation beyond the 


Absolute Maximum Ratings 


Operating Temperature 
During Fiead 2. oisso0% es ealdsdeas 0°C to 70°C(1) 
During Block Erase and 


WiGhO/B tO WIN. 6 os cadaees te evdxs: 0°C to 70°C “Operating Conditions” is not recommended and ex- 
Temperature Under Bias......... — 10°C to + 80°C tended exposure beyond the “Operating Conditions’’ 
Storage Temperature .......... ~65°Cia + 1aec . 2H abet can Reape: 


Voltage on Any Pin 
(except Vcc, Vpp, Ag and RP#) 


with Respect toGND........ —2.0V to + 7.0V(2) 
Voltage on Pin RP# or Pin Ag 
with Respectto GND ....... —2.0V to 13.5V(2, 3) 


Vpp Program Voltage with Respect 
to GND during Block Erase 


and Word/Byte Write ..... —2.0V to + 14.0V(2, 3) 
Voc Supply Voltage 

with Respect toGND........ —2.0V to +7.0V(2) 
Output Short Circuit Current............. 100 mA(4) 
NOTES: | 


1. Operating temperature is for commercial product defined by this specification. 

2. Minimum DC voltage is —0.5V on input/output pins. During transitions, this level may undershoot to —2.0V for periods 
<20 ns. Maximum DC voltage on input/output pins is Vcc + 0.5V which, during transitions, may overshoot to Voc + 2.0V 
for periods <20 ns. 

3. Maximum DC voltage on Vpp may overshoot to + 14.0V for periods <20 ns. Maximum DC voltage on RP# or Ag may 
overshoot to 13.5V for periods <20 ns. 

4. Output shorted for no more than one second. No more than one output shorted at a time. 

5. AC Specifications are valid at both voltage ranges. See DC Characteristics table for voltage range-specific specifications. 


OPERATING CONDITIONS 


Parameter 


| Symbol | | Notes | Min 

Ta | Operating Temperature | | 0 | 70 | °C 
| Voo__| VocSupply Voltage | 5 

| Voc | VooSupplyvotage | 5 | 450 | 550 | V_| 


DC CHARACTERISTICS Vcc = 3.3V +0.3V 


|____Parameter | Notes | Min | Typ | Max | Unit| _TestCondition 


lu Input Load Current 1 +1.0} pA | Voc = Voc Max 
Vin = Voc or GND 
ILo Output Leakage Current 1 +10} pA | Voc = Voc Max 
Vout = Vcc or GND 
locs Voc Standby Current 120 | wA | Voc = Voc Max 
CE# = RP# = Vcc +0.2V 
45 | 120 | pA | Voc = Voc Max 
CE# = RP# = Vin 
Vcc Deep Power-down Current V4 | eek Te ta RP# = GND +0.2V 
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DC CHARACTERISTICS Vcc = 3.3V +£0.3V (Continued) 


Symbol] _Parameter___—_—-_[Notes| Min |Typ| Max [Unit] TestCondition 


ICcR Vcc Read Current for 1; be mA |Vcc = Voc Max, CE# = GND 
28F200BX-L Word-Wide and f = 5 MHz, lout = OmA 
CMOS Inputs | 
mA |Voc = Vcc Max, CE# = Vi, 
f = 5 MHz, lout = OmA 
TTL Inputs 


Byte-Wide Mode and 

28F002BX-L Byte-Wide Mode 
Voc Word/Byte Write Current 1,4 ae en CS Word/Byte Write in Progress 
Voc Block Erase Current 1,4 A | Block Erase in Progress 


Vcc Erase Suspend Current 1,2 


Vep Standby Current | 
ae 


Vpp Deep Power-down Current 1 


Vpp Read Current 


el 

as 

a 

pe Oe 
icialesll Bl 
ae 

hd 


A | Block Erase Suspended, 
CE# = Vip 


Vpp < Voc 


A |RP# = GND +0.2V 


Vpp = VpPH 
Word Write in Progress 


‘S 
> 

< 

zy 

me) 
< 

QO 

.?) 


Vpp = VPPH 
Byte Write in Progress 


Vpp Byte Write Current at 
Vpp Block Erase Current aud 
Vpp Erase Suspend Current 


oe 
Ba 
mee 
fe 
of cede 
Bali 
bas 
ee 


> 


Vpp = VppH 
Block Erase in Progress 


Vpp = VppH 
Block Erase Suspended 


= = Ee 
Sstatatagieetan 


Voc = Vcc Min 
lon = —2mA 


Boot Block Write/Erase 


Vpp during Normal Operations 


VppH | Vpp during Erase/Write 
Operations 

Voc Erase/Write Lock Voltage 

RP # Unlock Voltage 
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CAPACITANCE(4) T, = 25°C, f = 1 MHz 


| Symbot_ | Parameter | Typ 
10 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Voc = 3.3V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (packages and speeds). 

2. Icces is specified with the device deselected. If the device is read while in Erase Suspend Mode, current draw is the sum 


of Icces and Iccr. 
3. Block Erases and Word/Byte Writes are inhibited when Vpp = Vpp, and not guaranteed in the range between Vppy and 


VPPL- . 

4. Sampled, not 100% tested. 

5. Automatic Power Savings (APS) reduces Iccr to less than 2 mA in static operation. 
6. CMOS Inputs are either Voc +0.2V or GND +0.2V. TTL Inputs are either Vi, or Vip. 


DC CHARACTERISTICS Vcc = 5.0V + 10%(4) 


Parameter Test Condition 


Input Load Current 1 Voc = Voc Max 
Vin = Voc or GND 
Output Leakage Current Voc = Voc Max 
Vout = Vcc or GND 


Voc = Vcc Max 

E# = RP# = Vin 
Voc = Vcc Max | 
CE# = RP# = Vcc +0.2V 


RP# = GND +0.2V 
Voc Read Current for 


28F200BX-L Word-Wide and f = 5 MHz, lout = OMA 
Byte-Wide Mode and CMOS Inputs 


28F002BX-L Byte-Wide 
Mode Voc = Vcc Max, CE# = Vi_ 


f = 5 MHz, lout = OmA 
TTL Inputs 


Vcc Word-Byte Write Current 1 Word or Byte Write in Progress 
Voc Block Erase Current 1 Block Erase in Progress 


IccES Voc Erase Suspend Current 1,2 Block Erase Suspended, 
CE# = Vip 


Vpp Deep Power-down 1 RP# = GND +0.2V 
Current 
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DC CHARACTERISTICS Vcc = 5.0V +10% (Continued) 


Symbol] __-Parameter_——| Notes| Min | Typ | Max | Unit| _ TestCondition 
ppp _|VppReadCurrent | t | 


IPpw Vpp Word Write Current 1 40 mA | Vpp = VppyH 
Word Write in Progress 
IPpw Vpp Byte Write Current 1 mA | Vpp = VppH 
Byte Write in Progress 
Vpp Block Erase Current 1 mA | Vpp = VppyH 
Block Erase in Progress 
Vpp Erase Suspend Current 1 LA | Vpp = Vppy 
Block Erase Suspended 


RP # Boot Block Unlock Current : wes 5004} | RP = Vay 
oe Wee ma ee 


Ag Intelligent Identifier Current 
Ag Intelligent Identifier Voltage 
Input Low Voltage 


Nae | 
ig | 
Input High Voltage 
lola 
VHH 


Output Low Voltage 0.45 V_ | Voc = Voc Min 
lo. = 5.8 mA 


Output High Voltage 


VPPL Vpp during Normal Operations 


VppH Vpp during Erase/Write 


Operations 
Voc Erase/Write Lock Voltage 


VHH RP # Unlock Voltage 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Vcc = 5.0V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (packages and speeds). 

2. Icces is specified with the device deselected. If the device is read while in Erase Suspend Mode, current draw is the sum 
of Icces and Iccr. 

3. Block Erase/Byte Writes are inhibited when Vpp = Vpp, and not guaranteed in the range between Vppy and Vpp,. 

4. All parameters are sampled, not 100% tested. 
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AC INPUT/OUTPUT REFERENCE WAVEFORM AC TESTING LOAD CIRCUIT 


3.0 = — res ‘isomer 
1.5 INPUT % ~<————— TEST POINTS ———>X 1.5 OUTPUT 
0.0 


DEVICE 


AC test inputs are driven at 3.0V for a Logic ‘‘1” and 0.0V for a logic “O”. TEST 
Input timing begins, and output timing ends, at 1.5V. Input rise and fall times 
(10% to 90%) < 10 ns. 


290449-16 
C. = 50 pF 
C. Includes Jig Capacitance 
R_ = 3.3 KN 
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28F200BX-L150 


Versions 28F002BX-L150 


[—Symbot[—Parameter 
8 


RC 
teHOz CE # High to Output High Z 
teLax OE # to Output Low Z 

tbF 


OE # High to Output High Z 


Output Hold from Addresses, 
CE # or OE# Change, 
Whichever is First 


CE # to BYTE# Switching 
Low to High 
BYTE # Switching High 3,4 
to Valid Output Delay 
BYTE # Switching Low 
to Output High Z 
NOTES: 


1. See AC Input/Output Reference Waveform for timing measurements. 

2. OE# may be delayed up to tce-tog after the falling edge of CE# without impact on toe. 

3. Sampled, not 100% tested. 

4. teLqv, BYTE# switching low to valid output delay will be equal to tayqy, measured from the time DQ;5/A_; becomes 
valid. 
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Figure 17. BYTE # Timing Diagram for Both Read and Write Operations for 28F200BX-L 
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AC CHARACTERISTICS For WE# Controlled Write Operations(1) Voc = 3.3V +0.3V, 5.0V +10% 


/ 28F200BX-L150 
(4) 


[Symbot [Parameter 


150 
1 


10 


0 
100 


10 


” ” 


[Notes 
ee 
det 
Loe 
| 6.8 
| 5.8 | 
oe 
oe 
Address Hold from WE # High 
a 
ar 
_ 
| 5.8 
| 6.8 


_ 
Oo 


tPHBR 


NOTES: 

1. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
characteristics during Read Mode. 

2. The on-chip WSM completely automates program/erase operations; program/erase algorithms are now controlled inter- 
nally which includes verify and margining operations. 

3. Refer to command definition table for valid Ajyj. 

4. Refer to command definition table for valid Dyn. 

5. Program/Erase durations are measured to valid SRD data (successful operation, SR.7 = 1). 

6. For Boot Block Program/Erase, RP # should be held at Vy until operation completes successfully. 

7. Time tpyppR is required for successful relocking of the Boot Block. 

8. Sampled but not 100% tested. 


Boot-Block Relock Delay 
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NOTES: 
1. 25°C, 12.0V Vpp. 
2. Excludes System-Level Overhead. 
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WRITE 


Vec POWER-UP ~—s- WRITE PROGRAM OR VALID ADDRESS & DATA(PROGRAM) AUTOMATED PROGRAM READ STATUS WRITE READ ARRAY 


& STANDBY ERASE SETUP COMMAND OR ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER DATA COMMAND 
V : 
4 PYXX) KKK KKK KKK A KKK KKK KKK AK KK KKK KN) 
wes ROK DRS RRR 
taVAV tavWH tWHAX 
Vin 
CE# (E) 
ViL 
ELL tWHEH 
Vin 
OE# (G) 
Vit 
tWHaV1,2,3,4 
Vin 
WE# (W) 
Vit awe 
tOvWH E 
V 
IH HIGH Z LTR vaio \\\ 
wot LF —{) KEY HD 
‘eHHWH tovPH 
Vn LS A ” 
’ 
6.5V 4 | ‘ 
Vin 
RP# (P) 
Vit 
: tovvi 
PPH (YX /\/ XY XY XY XXX XX} KXY XX KKKKK KKK KKK KY 
vn AORN RAR We WYK x 
PP Vin (\ O \/ X XKKKKKKKKK KY XXX VV YOK \/ XYXXXXXX \/ 
1, OY XXX KRXKKKKK 
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AC CHARACTERISTICS FOR CE #-CONTROLLED WRITE OPERATIONS | 
Voc = 3.3V £0.3V, 5.0V +10% 


ee 
28F002BX-L150 
| Symbol Parameter | 
Power | tos | RP# High Recovery to CE Going Low 
tDH i 4 
taH | 
t 


2) 


NO 
oO 


00 


2 
200 


Ce oo a 
rev | tu | Aauataasion Gee rag 
WE # Hold from CE # High 

CE # Pulse Width High 


tEHOV1 Duration of Word/Byte Programming 
Operation (Boot) 

/teHave | Duration of Erase Operation (Boot) 2,5,6 

Ptenava | Duration of Erase Operation (Parameter) 2, 3.6 


N 
So 
op) 


Duration of Erase Operation (Main) 
tvpH_| Vpp Hold from Valid SRD 


RP# Vii Hold from Valid SRD 
trupe | Boot-Block Relock Delay 7 


NOTES: 

1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of CE# and WE# in systems where 
CE# defines the write pulse-width (within a longer WE # timing waveform), all set-up, hold and inactive WE# time should be 
measured relative to the CE # waveforms. 

2, 3, 4, 5, 6, 7, 8: Refer to AC characteristics for WE #-controlled write operations. 

9. Read timing characteristics during write and erase operations are the same as during read-only operations. Refer to AC 
characteristics during read mode. 


” ” 
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Voc POWER-UP = WRITE PROGRAM OR __—‘ VALID snbakss & adh (PROGRAM) | AUTOMATED PROGRAM READ STATUS WRITE READ ARRAY 
& STANDBY ERASE SETUP COMMAND OR ERASE CONFIRM COMMAND OR ERASE DELAY REGISTER DATA COMMAND 
v 
wees CUCCCUCECCOV ECEECECUCECOUVECCEEOCECECES 
moses BAX IRRRRR RRR RRR 
taVAV tAVEH teHAX 
Vin : 
WE# (W) 
Vit 
{WLEL tEHWH 
ViH ; 
OE# (G) 
Vit 
teHov1,2,3,4 
Vin 
 CE# (E) 
: Vib Pact 
‘oven 
Vin Liga? LTR va \\\ 
Sieh ETC. { »  ) NN EI // <> 
— tovPH 
Vin OL oN ~ 
6.5V / ‘ 
Vin 
RP# (P) 
Vit 
; tovvi 
PPH KY XXX \/ XX YY \/ XX XX) KXXXXXX KX XY XX KKK KX 
ve ye RRO ONY Sesatacacolletatacelolletataretoll 
PP Viw COCO XXX KKKKKKKK KY XX KKK X OCCT ECE XXX X 
v, LOO XXXXXKKKXKRAKY 
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ORDERING INFORMATION 


BaOGgeoonneeeo 
an fa ACCESS SPEED (ns) 


PACKAGE hak 
— = STANDARD 56 LEAD TSOP : 
PA = 44 LEAD PSOP 


eqztetrfopofzfetxy-[et itso} 


oN TT ACCESS SPEED (ns) ; 


PACKAGE 150ns 
—E = STANDARD 40 LEAD TSOP 
290449-21 
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VALID COMBINATIONS: 
E28F002BX-L150 


VALID COMBINATIONS: 
E28F200BX-L150 PA28F200BX-L150 


Additional Information Order Number 
28F200BX/28F002BxX Datasheet 290448 
28F400BX/28F004BxX Datasheet 290451 
28F400BXL/28F004BXL Datasheet 290450 
AP-363 “Extended Flash BIOS Design for Portable Computers” 292098 
AP-357 ‘Power Supply Solutions for Flash Memory” 292092 
ER-28 “ETOX-III Flash Memory Technology” 294012 


ER-29 “The Intel 2/4 Mbit Boot Block Flash Memory Family” 294013 


REVISION HISTORY 


Member et On, hy Retaelen Optra 
Original Version 


Modified BYTE # AC Timings 
Modified tpywuH parameter for AC Characteristics for Write Operations 


PWD renamed to RP# for JEDEC standardization compatibility. 

Combined Vcc Read Current for 28F200BX-L Word-Wide and Byte-Wide Mode and 
28F002BX-L Byte-Wide Mode in DC Characteristics tables. 

Changed Ipps current spec from +10 pA to +15 pA in DC Characteristics table. 

Added Boot Block Unlock current spec in DC Characteristics tables. 

Improved tpwH spec to 600 ns (was 700 ns) 

Changed Iccr current spec from 20 mA maximum to 25 mA maximum and added typical spec 
to DC Characteristics table. 3 
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28F001BX-T/28F001BX-B 
1M (128K x 8) CMOS FLASH MEMORY 


m@ High Integration Blocked Architecture m@ High-Performance Read 
— One 8 KB Boot Block w/Lock Out — 120 ns Maximum Access Time 
— Two 4 KB Parameter Blocks —5.0V +10% Vcc 


— One 112 KB Main Block m Hardware Data Protection Feature 


m@ 100,000 Erase/Program Cycles Per — Erase/Write Lockout during Power 
Block Transitions 
m@ Simplified Program and Erase m Advanced Packaging, JEDEC Pinouts 
— Automated Algorithms via On-Chip — 32-Pin PDIP 
Write State Machine (WSM) — 32-Lead PLCC, TSOP 
m= SRAM-Compatible Write Interface m@ ETOX Il Nonvolatile Flash Technology 


— EPROM-Compatible Process Base 
— 0.05 »A Icc Typical — High-Volume Manufacturing 
— 0.8 A Ipp Typical Experience 

m 12.0V +5% Vpp m Extended Temperature Options 


m Deep-Powerdown Mode 


Intel’s 28F001BX-B and 28F001BX-T combine the cost-effectiveness of Intel standard flash memory with 
features that simplify write and allow block erase. These devices aid the system designer by combining the 
functions of several components into one, making boot block flash an innovative alternative to EPROM and 
EEPROM or battery-backed static RAM. Many new and existing designs can take advantage of the 
28F001BX’s integration of blocked architecture, automated electrical reprogramming, and standard processor 
interface. 


The 28F001BX-B and 28F001BX-T are 1,048,576 bit nonvolatile memories organized as 131,072 bytes of 
8 bits. They are offered in 32-pin plastic DIP, 32-lead PLCC and 32-lead TSOP packages. Pin assignment 
conform to JEDEC standards for byte-wide EPROMs. These devices use an integrated command port and 
state machine for simplified block erasure and byte reprogramming. The 28F001BX-T’s block locations pro- 
vide compatibility with microprocessors and microcontrollers that boot from high memory, such as Intel’s 
MCS-186 family, 80286, i386™, i486™, i860™ and 80960CA. With exactly the same memory segmentation, 
the 28F001BX-B memory map is tailored for microprocessors and microcontrollers that boot from low memory, 
such as Intel’s MCS-51, MCS-196, 80960KX and 80960SX families. All other features are identical, and unless 
otherwise noted, the term 28F001BX can refer to either device throughout the remainder of this document. 


The boot block section includes a reprogramming write lock out feature to guarantee data integrity. It is 
designed to contain secure code which will bring up the system minimally and download code to the other 
locations of the 28F001BxX. Intel’s 28F001BX employs advanced CMOS circuitry for systems requiring high- 
performance access speeds, low power consumption, and immunity to noise. Its 120 ns access time provides 
no-WAIT-state performance for a wide range of microprocessors and microcontrollers. A deep-powerdown 
mode lowers power consumption to 0.25 ,W typical through Vcc, crucial in laptop computer, handheld instru- 
mentation and other low-power applications. The RP # power control input also provides absolute data protec- 
tion during system powerup or power loss. 


Manufactured on Intel’s ETOX process base, the 28F001BX builds on years of EPROM experience to yield the 
highest levels of quality, reliability, and cost-effectiveness. 


October 1993 
Order Number: 290406-005 4-179 
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Figure 1. 28F001BX Block Diagram 
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Table 1. Pin Description 


| Symbol | Type | Name and Function 


Ao-Aié6 INPUT | ADDRESS INPUTS for memory addresses. Addresses are internally latched during 
a write cycle. 


DQ 9-DQ7 | INPUT/ | DATAINPUTS/OUTPUTS: Inputs data and commands during memory write 
OUTPUT | cycles; outputs data during memory, Status Register and Identifier read cycles. The 
data pins are active high and float to tri-state off when the chip is deselected or the 
. outputs are disabled. Data is internally latched during a write cycle. 

OE# INPUT 
read cycle. OE # is active low. OF # = Vp (pulsed) allows programming of the 
boot block. 

WE # INPUT | WRITE ENABLE: Controls writes to the Command Register and array blocks. WE # 
is active low. Addresses and data are latched on the rising edge of the WE# pulse. 

Vpp ERASE/PROGRAM POWER SUPPLY for erasing blocks of the array or 
programming bytes of each block. Note: With Vpp < Vpp;, max, memory contents 

Vcc | ~——s«s| DEVICE POWER SUPPLY: (5V + 10%) 


cannot be altered. 
POR Rel ei Nc GUO Se ke tA i A Teer GE Obie on Pee ee 
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CHIP ENABLE: Activates the device’s control logic, input buffers, decoders and 
sense amplifiers. CE # is active low; CE # high deselects the memory device and 
reduces power consumption to standby levels. 


POWERDOWN: Puts the device in deep powerdown mode. FP # is active low; 
RP # high gates normal operation. RP# = Vyp allows programming of the boot - 
block. RP # also locks out erase or write operations when active low, providing data 
protection during power transitions. RP # active resets internal automation. Exit 
from deep powerdown sets device to Read Array mode. 


OUTPUT ENABLE: Gates the device’s outputs through the data buffers during a 
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P28F001BX 
32-PIN 
PDIP 
9 0.62"'x 1.64" 
19 TOP VIEW 
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Figure 2. DIP Pin Configuration 


STANDARD PINOUT 
E28F001BX 
32 LEAD TSOP 
8mm x 20mm 
TOP VIEW 
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Figure 3. TSOP Lead Configuration 
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N28F00 1BX 


32 LEAD PLCC 
0.450" x0.550” 


TOP VIEW 


Figure 4. PLCC Lead Configuration 


APPLICATIONS 


The 28F001BxX flash ‘boot block’ memory augments 
the non-volatility, in-system electrical erasure and 
reprogrammability of Intel’s standard flash memory 
by offering four separately erasable blocks and inte- 
grating a state machine to control erase and pro- 
gram functions. The specialized blocking architec- 
ture and automated programming of the 28F001BX 
provide a full-function, non-volatile flash memory 
ideal for a wide range of applications, including PC 
boot/BIOS memory, minimum-chip embedded pro- 
gram memory and parametric data storage. The 
28F001BX combines the safety of a hardware-pro- 
tected 8-KByte boot block with the flexibility of three 
separately reprogrammable blocks (two 4-KByte pa- 
rameter blocks and one 112-KByte code block) into 
one versatile, cost-effective flash memory. Addition- 
ally, reprogramming one block does not affect code 
stored in another block, ensuring data integrity. 


4-182 


The flexibility of flash memory reduces costs 
throughout the life cycle of a design. During the early 
stages of a system’s life, flash memory reduces pro- 
totype development and testing time, allowing the 
system designer to modify in-system software elec- 
trically versus manual removal of components. Dur- 
ing production, flash memory provides flexible firm- 
ware for just-in-time configuration, reducing system 
inventory and eliminating unnecessary handling and 
less reliable socketed connections. Late in the life 
cycle, when software updates or code ‘“‘bugs” are 
often unpredictable and costly, flash memory reduc- 
es update costs by allowing the manufacturers to 
send floppy updates versus a technician. Alterna- 
tively, remote updates over a communication link are 
possible at speeds up to 9600 baud due to flash 
memory’s fast programming time. 


intel. 


Reprogrammable environments, such as the per- 
sonal computer, are ideal applications for the 
28F001BX. The internal state machine provides 
SRAM-like timings for program and erasure, using 
the Command and Status Registers. The blocking 
scheme allows BIOS update in the main and param- 
eter blocks, while still providing recovery code in the 
boot block in the unlikely event a power failure oc- 
curs during an update, or where BIOS code is cor- 
rupted. Parameter blocks also provide convenient 
configuration storage, backing up SRAM and battery 
configurations. EISA systems, for example, can 
store hardware configurations in a flash parameter 
block, reducing system SRAM. 


Laptop BIOSs are becoming increasingly complex 
with the addition of power management software 
and extended system setup screens. BIOS code 
complexity increases the potential for code updates 
after the sale, but the compactness of laptop de- 
signs makes hardware updates very costly. Boot 
block flash memory provides an inexpensive update 
solution for laptops, while reducing laptop obsoles- 
cence. For portable PCs and hand-held equipment, 
the deep powerdown mode dramatically lowers sys- 
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Figure 5. 28F001BX-T in a 80C188 System 
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tem power requirements during periods of slow op-' 
eration or sleep modes. 


The 28F001BX gives the embedded system design- 
er several desired features. The internal state ma- 
chine reduces the size of external code dedicated to 
the erase and program algorithms, as well as freeing 
the microcontroller or microprocessor to respond to 
other system requests during program and erasure. 
The four blocks allow logical segmentation of the 
entire embedded software: the 8-KByte block for the 
boot code, the 112-KByte block for the main pro- 
gram code and the two 4-KByte blocks for updatable 
parametric data storage, diagnostic messages and 
data, or extensions of either the boot code or pro- 
gram code. The boot block is hardware protected 
against unauthorized write or erase of its vital code 
in the field. Further, the powerdown mode also locks 
out erase or write operations, providing absolute 
data protection during system powerup or power 
loss. This hardware protection provides obvious ad- 
vantages for safety related applications such as 
transportation, military, and medical. The 28F001BX 
is well suited for minimum-chip embedded applica- 
tions ranging from communications to automotive. 
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Figure 6. 28F001BX-B in a 80C51 System 
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- PRINCIPLES OF OPERATION 


The 28F001BX introduces on-chip write automation 
to manage write and erase functions. The write state 
machine allows for: 100% TTL-level control inputs; 
fixed power supplies during erasure and program- 
ming; minimal processor overhead with RAM-like 
write timings, and maximum EPROM compatiblity. 


After initial device powerup, or after return from 
deep powerdown mode (see Bus Operations), the 
28F001BX functions as a read-only memory. Manip- 
ulation of external memory-control pins yield stan- 
dard EPROM read, standby, output disable or Intelli- 
gent Identifier operations. Both Status Register and 
Intelligent Identifiers can be accessed through the 
Command Register when Vpp = Vpp,. 


This same subset of operations is also available 
when high voltage is applied to the Vpp pin. In addi- 
tion, high voltage on Vpp enables successful erasure 
and programming of the device. All functions associ- 
ated with altering memory contents—program, 
erase, Status, and intgligent Identifier—are accessed 
via the Command Register and verified through the 
Status Register. | 


Commands are written using standard microproces- 
sor write timings. Register contents serve as input to 
the WSM, which controls the erase and program- 
ming circuitry. Write cycles also internally latch ad- 
dresses and data needed for programming or erase 
operations. With the appropriate command written to 
the register, standard microprocessor read timings 
output array data, access the intelligent identifier 
codes, or output program and erase status for verifi- 
cation. 


Interface software to initiate and poll progress of in- 
ternal program and erase can be stored in any of the 
28F001BX blocks. This code is copied to, and exe- 
cuted from, system RAM during actual flash memory 
update. After successful completion of program 
and/or erase, code execution out of the 28F001BX 
is again possible via the Read Array command. 
Erase suspend/resume capability allows system 
software to suspend block erase and read data/exe- 
cute code from any other block. 


Command Register and Write 
Automation 


An on-chip state machine controls block erase and 
byte program, freeing the system processor for other 
tasks. After receiving the erase setup and erase 
confirm commands, the state machine controls 
block pre-conditioning and erase, returning progress 
via the Status Register. Programming is similarly 
controlled, after destination address and expected 
data are supplied. The program algorithm of past In- 
tel Flash Memories is now regulated by the state 
machine, including program pulse repetition where 
required and internal verification and margining of 
data. 
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Depending on the application, the system designer 
may choose to make the Vpp power supply switcha- 
ble (available only when memory updates are re- 
quired) or hardwired to Vppy. When Vpp = Vpp,, 
memory contents cannot be altered. The 28F001BX 
Command Register architecture provides protection 
from unwanted program or erase operations even 
when high voltage is applied to Vpp. Additionally, all 
functions are disabled whenever Vcc is below the 
write lockout voltage ViKo, or when RP # is at Vj,. 
The 28F001BX accommodates either design prac- 
tice and encourages optimization of the processor- 
memory interface. 


Data Protection 


The two-step program/erase write sequence to the 
Command Register provides additional software 
write protection. 


8-KByte BOOT BLOCK 


4-KByte PARAMETER BLOCK 


4-KByte PARAMETER BLOCK 


112-KByte MAIN BLOCK 


Figure 7. 28F001BX-T Memory Map 


112-KByte MAIN BLOCK 


4-KByte PARAMETER BLOCK 


4-KByte PARAMETER BLOCK 


8-KByte BOOT BLOCK 


Figure 8. 28F001BX-B Memory Map 
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BUS OPERATION 


Flash memory reads, erases and writes in-system 
via the local CPU. All bus cycles to or from the flash 
memory conform to standard microprocessor bus 
cycles. 


Read 


The 28F001BX has three read modes. The memory 
can be read from any of its blocks, and information 
can be read from the Intelligent Identifier or the 
Status Register. Vpp can be at either Vpp, or Vppy. 


The first task is to write the appropriate read mode 
command to the Command Register (array, Intelli- 
gent Identifier, or Status Register). The 28F001BX 
automatically resets to Read Array mode upon initial 
device powerup or after exit from deep powerdown. 
The 28F001BX has four control pins, two of which 
must be logically active to obtain data at the outputs. 
Chip Enable (CE#) is the device selection control, 
and when active enables the selected memory de- 
vice. Output Enable (OE #) is the data input/output 
(DQ9-DQ7) direction control, and when active 
drives data from the selected memory onto the I/O 
bus. RP# and WE# must also be at Vip. Figure 12 
illustrates read bus cycle waveforms. 


Output Disable 


With OE # at a logic-high level (Vj), the device out- 
puts are disabled. Output pins (DQ 9-DQ7) are 
placed in a high-impedance state. 
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Standby 


CE # at a logic-high level (Vj}4) places the 28F001BX 
in standby mode. Standby operation disables much 
of the 28F001BX’s circuitry and substantially reduc- 
es device power consumption. The outputs (DQ 9- 
DQ7) are placed in a high-impedance state indepen- 
dent of the status of OE #. If the 28F001BX is dese- 
lected during erase or program, the device will 
continue functioning and consuming normal active 
power until the operation is completed. 


Deep Power-Down 


The 28F001BX offers a 0.25 wW Vcc power-down 
feature, entered when RP# is at Vi. During read 
modes, RP # low deselects the memory, places out- 
put drivers in a high-impedance state and turns off 
all internal circuits. The 28F001BX requires time 
tpHaqv (see AC Characteristics-Read Only Opera- 
tions) after return from power-down until initial mem- 
ory access outputs are valid. After this wakeup inter- 
val, normal operation is restored. The Command 
Register is reset to Read Array, and the Status Reg- 
ister is cleared to value 80H, upon return to normal 
operation. 


During erase or program modes, RP # low will abort 
either operation. Memory contents of the block be- 
ing altered are no longer valid as the data will be 
partially programmed or erased. Time tpyw , after 
RP# goes to logic-high (Viy) is required before an- 
other command can be written. 


Table 2. 28F001BX Bus Operations 


Notes 
4 


| Min 


Nie | 


NOTES: 


1. Refer to DC Characteristics. When Vpp = Vpp,, memory contents can be read but not programmed or erased. 

2. X can be Vi, or Viy for control pins and addresses, and Vpp, or Vppy for Vpp. 

3. See DC Characteristics for Vpp_, VppH, VHH and Vip voltages. 

4. Manufacturer and device codes may also be accessed via a Command Register write sequence. Reier to Table 3. Ay—Ag, 


Aio—Ai6 = Vit 


5. Device ID = 94H for the 28F001BX-T and 95H for the 28F001BX-B. 
6. Command writes involving block erase or byte program are successfully executed only when Vpp = Vppy. 


7. Refer to Table 3 for valid Dijj during a write operation. 


8. Program or erase the boot block by holding RP# at Vy or toggling OE # to Vy. See AC Waveforms for program/erase 


operations. 


4-185 


28F001BX-T/28F001BX-B 


The use of RP# during system reset is important 
with automated write/erase devices. When the sys- 
tem comes out of reset it expects to read from the 
flash memory. Automated flash memories provide 
status information when accessed during write/ 
erase modes. If a CPU reset occurs with no flash 
memory reset, proper CPU initialization would not 
occur because the flash memory would be providing 
the status information instead of array data. Intel’s 
Flash Memories allow proper CPU initialization fol- 
lowing a system reset through the use of the RP# 
input. In this application RP# is controlled by the 
same RESET # signal that resets the system CPU. 


intelligent Identifier Operation 


The Intelligent Identifier operation outputs the manu- 
facturer code, 89H; and the device code, 94H for the 
28F001BX-T and 95H for the 28F001BX-B. Pro- 
gramming equipment or the system CPU can then 
automatically match the device with its proper erase 
and programming algorithms. 


PROGRAMMING EQUIPMENT 


CE# and OE# at a logic low level (Vj), with Ag at 
high voltage Vip (see DC Characteristics) activates 
this operation. Data read from locations OO000H and 
00001H represent the manufacturer’s iii and the 
device code respectively. 


IN-SYSTEM PROGRAMMING 


The manufacturer- and device-codes can also be 
read via the Command Register. Following a write of 
90H to the Command Register, a read from address 
location OOOOOH outputs the manufacturer code 


(89H). A read from address 00001H outputs the de-. 


vice code (94H for the 28F001BX-T and 95H for the 
28F001BX-B). It is not necessary to have high volt- 
age applied to Vpp to read the Intelligent Identifiers 
from the Command Register. 


Write 


Writes to the Command Register allow read of de- 
vice data and Intelligent Identifiers. They also con- 
trol inspection and clearing of the Status Register. 
Additionally, when Vpp = Vppy, the Command Reg- 
ister controls device erasure and programming. The 
contents of the register serve as input to the internal 
state machine. 


The Command Register itself does not occupy an 
addressable memory location. The register is a latch 


used to store the command and address and data 


information needed to execute the command. Erase 
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Setup and Erase Confirm commands require both 
appropriate command data and an address within 
the block to be erased. The Program Setup Com- 
mand requires both appropriate command data and 
the address of the location to be programmed, while 
the Program command consists of the data to be 
written and the address of the location to be pro- 
grammed. 


The Command Register is written by bringing WE # 
to a logic-low level (Vi) while CE # is low. Address- 
es and data are latched on the rising edge of WE#. 
Standard microprocessor write timings are used. 


Refer to AC Write Characteristics and the AC Wave- 
form for Write Operations, Figure 13, for specific tim- 
ing parameters. 


COMMAND DEFINITIONS 


When Vpp, is applied to the Vpp pin, read opera- 
tions from the Status Register, intelligent identifiers, 
or array blocks are enabled. Placing Vppy on Vpp 
enables successful program and erase operations 
as well. 


Device operations are selected by writing specific 
commands into the Command Register. Table 3 de- 
fines these 28F001BX commands. 


Read Array Command 


Upon initial device powerup and after exit from 
deep-powerdown mode, the 28F001BX defaults to 
Read Array mode. This operation is also initiated by 
writing FFH into the Command Register. Microproc- 
essor read cycles retrieve array data. The device re- 
mains enabled for reads until the Command Regis- 
ter contents are altered. Once the internal write 
state machine has started an erase or program op- 
eration, the device will not recognize the Read Array 
command, until the WSM has completed its opera- 
tion. The Read Array command is functional when 


Vpp = Vppi or VppH. 


intelligent Identifier Command for 
In-System Programming 


The 28F001BX contains an Intelligent Identifier op- 
eration to supplement traditional PROM-program- 
ming methodology. The operation is initiated by writ- 
ing 90H into the Command Register. Following the 
command write, a read cycle from address 00000H 
retrieves the manufacturer code of 89H. A read cy- 
cle from address 00001H returns the device code of 
94H (28F001BX-T) or 95H (28F001BX-B). To termi- 
nate the operation, it is necessary to write another 
valid command into the register. Like the Read Array 
command, the Intelligent Identifier command is func- 
tional when Vpp = Vpp_ or Vppp. 
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Table 3. 28F001BX Command Definitions 


NOTES: 
1. Bus operations are defined in Table 2. 


wite | x sow] Read | 1A | 10 


wt 


2. |A = Identifier Address: OOH for manufacturer code, 01H for device code. 


BA = Address within the block being erased. 
PA = Address of memory location to be programmed. 


3. SRD = Data read from Status Register. See Table 4 for a description of the Status Register bits. 
PD = Data to be programmed at location PA. Data is latched on the rising edge of WE#. 


IID = Data read from Intelligent Identifiers. 


4. Following the Intelligent Identifier command, two read operations access manufacture and device codes. 
5. Commands other than those shown above are reserved by Intel for future device implementations and should not be 


used. 


Read Status Register Command 


The 28F001BX contains a Status Register which 
may be read to determine when a program or erase 
operation is complete, and whether that operation 
completed successfully. The Status Register may be 
read at any time by writing the Read Status Register 
command (70H) to the Command Register. After 
writing this command, all subsequent read opera- 
tions output data from the Status Register, until an- 
other valid command is written to the Command 
Register. The contents of the Status Register are 
latched on the falling edge of OE # or CE#, which- 
ever occurs last in the read cycle. OE# or CE# 
must be toggled to Vj} before further reads to up- 
date the Status Register latch. The Read Status 
Register command functions when Vpp = Vpp_ or 


VPPH: 


Clear Status Register Command 


The Erase Status and Program Status bits are set to 
“1”? by the Write State Machine and can only be 


reset by the Clear Status Register command. These 
bits indicate various failure conditions (see Table 4). 
By allowing system software to control the resetting 
of these bits, several operations may be performed 
(such as cumulatively programming several bytes or 
erasing multiple blocks in sequence). The Status 
Register may then be polled to determine if an error 
occurred during that series. This adds flexibility to 
the way the device may be used. 


Additionally, the Vpp Status bit (SR.3), when set to 
“1”, MUST be reset by system software before fur- 
ther byte programs or block erases are attempted. 
To clear the Status Register, the Clear Status Regis- 
ter command (504) is written to the Command Reg- 
ister. The Clear Status Register command is func- 
tional when Vpp = Vpp_ or Vppy. 


4-187 


+ : Ve , » J 4 . 
: 5: pee rai 


28F001BX-T/28F001BX-B 


Table 4. 28F001BX Status Register Definitions 


= WRITE STATE MACHINE STATUS 
= Ready 
= Busy 


.6 = ERASE SUSPEND STATUS 
1 = Erase Suspended 
0 = Erase In Progress/Completed 


5 = ERASE STATUS 
1 = Error in Block Erasure 
0 = Successful Block Erase 


= PROGRAM STATUS 
1 = Error in Byte Program 


0 = Successful Byte Program 

SR.3 = Vpp STATUS 
1 = Vpp Low Detect; Operation Abort 
0 = Vpp OK 


SR.2-SR.0 = RESERVED FOR FUTURE ENHANCE- 
MENTS 

These bits are reserved for future use and should be 
masked out when polling the Status Register. 


Erase Setup/Erase Confirm 
Commands 


Erase is executed one block at a time, initiated by a 
two-cycle command sequence. An Erase Setup 
command (20H) is first written to the Command 
Register, followed by the Erase Confirm command 
(DOH). These commands require both appropriate 
command data and an address within the block to 
be erased. Block preconditioning, erase and verify 
are all handled internally by the Write State Machine, 
invisible to the system. After receiving the two-com- 
mand erase sequence, the 28F001BX automatically 
outputs Status Register data when read (see Figure 
10; Block Erase Flowchart). The CPU can detect the 
completion of the erase event by checking the WSM 
Status bit of the Status Register (SR.7). 


When the Status Register indicates that erase is 
complete, the Erase Status bit should be checked. If 
erase error is detected, the Status Register should 
be cleared. The Command Register remains in Read 
Status Register Mode until further commands are is- 
sued to it. 


This two-step sequence of set-up followed by execu- 
tion ensures that memory contents are not acciden- 
tally erased. Also, block erasure can only occur 
when Vpp = Vppy. In the absence of this high volt- 
age, memory contents are protected against era- 
sure. If block erase is attempted while Vpp = Vpp,, 
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NOTES: 

The Write State Machine Status Bit must first be checked 
to determine program or erase completion, before the 
Program or Erase Status bits are checked for success. 


If the Program AND Erase Status bits are set to “1s” dur- 
ing an erase attempt, an improper command sequence 
was entered. Attempt the operation again. 


lf Vpp low status is detected, the Status Register must be 
cleared before another program or erase operation is at- 
tempted. 


The Vpp Status bit, unlike an A/D converter, does not 
provide continuous indication of Vpp level. The WSM in- 
terrogates the Vpp level only after the program or erase 
command sequences have been entered and informs the 
system if Vpp has not been switched on. The Vpp Status 
bit is not guaranteed to report accurate feedback be- 
tween Vpp, and Vppy. 


the Vpp Status bit will be set to “1”. Erase attempts 
while Vpp_ < Vpp < Vppy produce spurious results 
and should. not be attempted. 


Erase Suspend/Erase Resume 
Commands 


The Erase Suspend Command allows erase se- 
quence interruption in order to read data from anoth- 
er block of memory. Once the erase sequence is 
started, writing the Erase Suspend command (BOH) 
to the Command Register requests that the WSM 
suspend the erase sequence at a predetermined 
point in the erase algorithm. The 28F001BX contin- 
ues to output Status Register data when read, after 
the Erase Suspend command is written to it. Polling 
the WSM Status and Erase Suspend Status bits will 
determine when the erase operation has been sus- 
pended (both will be set to “1s’’). 


At this point, a Read Array command can be written 
to the Command Register to read data from blocks 
other than that which is suspended. The only oth- 
er valid commands at this time are Read Status Reg- 
ister (70H) and Erase Resume (DOH), at which time 
the WSM will continue with the erase sequence. The 
Erase Suspend Status and WSM Status bits of the 
Status Register will be cleared. After the Erase Re- 
sume command is written to it, the 28F001BX auto- 
matically outputs Status Register data when read 
(see Figure 11; Erase Suspend/Resume Flowchart). 


intel. 
Program Setup/Program Commands 


Programming is executed by a two-write sequence. 
The program Setup command (40H) is written to the 
Command Register, followed by a second write 
specifying the address and data (latched on the ris- 
ing edge of WE#) to be programmed. The WSM 
then takes over, controlling the program and verify 
algorithms internally. After the two-command pro- 
gram sequence is written to it, the 28F001BX auto- 
matically outputs Status Register data when read 
(see figure 9; Byte Program Flowchart). The CPU 
can detect the completion of the program event by 
analyzing the WSM Status bit of the Status Register. 
Only the Read Status Register command is valid 
while programming is active. 


When the Status Register indicates that program- 
ming is complete, the Program Status bit should be 
checked. If program error is detected, the Status 
Register should be cleared. The internal WSM verify 
only detects errors for “1s” that do not successfully 
program to ‘Os’. The Command Register remains in 
Read Status Register mode until further commands 
are issued to it. If byte program is attempted while 
Vpp = Vpp_, the Vpp Status bit will be set to “1”. 
Program attempts while Vpp_ < Vpp < Vppy pro- 
duce spurious results and should not be attempted. 


EXTENDED ERASE/PROGRAM 
CYCLING 


EEPROM cycling failures have always concerned 
users. The high electrical field required by thin oxide 
EEPROMs for tunneling can literally tear apart the 
oxide at defect regions. To combat this, some sup- 
pliers have implemented redundancy schemes, re- 
ducing cycling failures to insignificant levels. Howev- 
er, redundancy requires that cell size be doubled; an 
expensive solution. : 


Intel has designed extended cycling capability into 
its ETOX flash memory technology. Resulting im- 
provements in cycling reliability come without in- 
creasing memory cell size or complexity. First, an 
advanced tunnel oxide increases the charge carry- 
ing ability ten-fold. Second, the oxide area per cell 
subjected to the tunneling electrical field is one- 
tenth that of common EEPROMs, minimizing the 
probability of oxide defects in the region. Finally, the 
peak electric field during erasure is approximately 2 
Mv/cm lower than EEPROM. The lower electric field 
greatly reduces oxide stress and the probability of 
failure; increasing time to wearout by a factor of 
100,000,000. 


28F001BX-T/28F001BX-B 


The 28F001BX-B and 28F001BX-T are capable of 
100,000 program/erase cycles on each of the two 
parameter blocks, main block and boot block. 


ON-CHIP PROGRAMMING 
ALGORITHM 


The 28F001BX integrates the Quick Pulse program- 
ming algorithm of prior Intel Flash Memory devices 
on-chip, using the Command Register, Status Regis- 
ter and Write State Machine (WSM). On-chip inte- 
gration dramatically simplifies system software and 
provides processor-like interface timings to the 
Command and Status Registers. WSM operation, in- 
ternal program verify and Vpp high voltage presence 
are monitored and reported via appropriate Status 
Register bits. Figure 9 shows a system software 
flowchart for device programming. The entire se- 
quence is performed with Vpp at Vppy. Program 
abort occurs when RP # transitions to V\,, or Vpp 
drops to Vpp,. Although the WSM is halted, byte 
data is partially programmed at the location where 
programming was aborted. Block erasure or a re- 
peat of byte programming will initialize this data to a 
known value. 


ON-CHIP ERASE ALGORITHM 


As above, the Quick Erase algorithm of prior Intel 
Flash Memory devices is now implemented internal- 
ly, including all preconditioning of block data. WSM 
operation, erase success and Vpp high voltage pres- 
ence are monitored and reported through the Status 
Register. Additionally, if a command other than 
Erase Confirm is written to the device after Erase 
Setup has been written, both the Erase Status and 
Program Status bits will be set to “1”. When issuing 
the Erase Setup and Erase Confirm commands, they 
should be written to an address within the address 
range of the block to be erased. Figure 10 shows a | 
system software flowchart for block erase. | 


Erase typically takes 1-4 seconds per block. The 
Erase Suspend/Erase Resume command sequence 
allows interrupt of this erase operation to read data 
from a block other than that in which erase is 
being performed. A system software flowchart is 
shown in Figure 11. 


The entire sequence is performed with Vpp at Vppy. 
Abort occurs when RP# transitions to Vi, or Vpp 
falls to Vpp,, while erase is in progress. Block data is 
partially erased by this operation, and a repeat of 
erase is required to obtain a fully erased block. 
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BOOT BLOCK PROGRAM AND 
ERASE 


The boot block is intended to contain secure code 
which will minimally bring up a system and control 
programming and erase of other blocks of the de- 
vice, if needed. Therefore, additional “lockout” pro- 
tection is provided to guarantee data integrity. Boot 
block program and erase operations are enabled 
through high voltage Vu on either RP# or OE#, 
and the normal program and erase command se- 
quences are used. Reference the AC Waveforms for 
Program/Erase. 


If boot block program or erase is attempted while 
.RP# is at Vip, either the Program Status or Erase 
Status bit will be set to “1”, reflective of the opera- 


Write 40H, 
Byte Address 


Write Byte 
Address/Data 
Read Status 

Register 


oe 


YES 
Full Status 

Check if Desired 

Byte Program 
Completed 

FULL STATUS CHECK PROCEDURE 
Status Register Data 
Read (See Above 


Vpp Range 
Error 


Byte Program 
Error 


Byte Program 
Successful 


a 
Intel. 
tion being attempted and indicating boot block lock. 
Program/erase attempts while Vijy < RP# < Vuy 


produce spurious results and should not be attempt- 
ed. 


in-System Operation 


For on-board programming, the RP # pin is the most 
convenient means of altering the boot block. Before 
issuing Program or Erase confirms commands, RP # 
must transition to Vuy. Hold RP# at this high volt- 
age throughout the program or erase interval (until 
after Status Register confirm of successful comple- 
tion). At this time, it can return to Vj or Vj. 


Bus 


Program | Data = 40H 
Setup Address = Byte to be 
Programmed 


Program | Data to be programmed 
Address = Byte to be 


Programmed 
Read Status Register Data. 
Toggle OE # or CE# to 


update Status Register 
Check SR.7 


1 = Ready, 0 = Busy 
Repeat for subsequent bytes. 


Standby 


Full status check can be done after each byte or after a 
sequence of bytes. 


Write FFH after the last byte programming operation to 
reset the device to Read Array Mode. 


Bus Command Comments 
Operation 


Check SR.3 
1 = Vpp Low Detect 


Standby 


Check SR.4 
1 = Byte Program Error 


SR.3 MUST be cleared, if set during a program attempt, 
before further attempts are allowed by the Write State 
Machine. 


Standby 


SR.4 is only cleared by the Clear Status Register 
Command, in cases where multiple bytes are 
programmed before full status is checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 9. 28F001BX Byte Programming Flowchart 
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Write 20H, 
Block Address 


Write DOH, 
Block Address 


Read Status 
Register 


YES 
Full Status 
Check if Desired 


Block Erase 
Completed 


Erase Suspend 
Loop 


FULL STATUS CHECK PROCEDURE 


Status Register Data 
Read (See Above 


YES 


Block Erase 
Successful 


Vpp Range 
Error 
Command Sequence 
Error 
Block Erase 
Error 
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Bus 


Data = 20H 
Address = Within Block to be erased 


Data = DOH 
Address = Within Block to be erased 


Status Register Data. 
Toggle OE # or CE # to update Status 
Register 


Standby Check SR.7 


= Ready, 0 = Busy 
Repeat for subsequent blocks. 


Full status check can be done after each block or after a sequence of 
blocks. 


Write FFH after the last block erase operation to reset the device to 
Read Array Mode. 


Bus 
[operon | Command | Commenta 


Check SR.3 
1 = Vpp Low Detect 


Standby Check SR.4, 5 


Both 1 = Command Sequence Error 


Standby Check SR.5 


1 = Block Erase Error 


SR.3 MUST be cleared, if set during an erase attempt, before further 
attempts are allowed by the Write State Machine. 


SR.5 is only cleared by the Clear Status Register Command, in cases 
where multiple blocks are erased before full status is checked. 


If error is detected, clear the Status Register before attempting retry or 
other error recovery. 


Figure 10. 28F001BX Block Erase Flowchart 
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Write BOH 


Write 70H 


Read Status 
Register 


Erase Has 
Completed 
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Operation 


Erase Data = BOH 


Suspend 


Erase Data = 70H 


Status Register 


Standby/ 
Read 


Read Status Register 
Check SR.7 

1 = Ready, 0 = Busy 
Toggle OE # or CE# to 
Update Status Register 


Check SR.6 
1 = Suspended 


Standby 


Read Array Data = FFH 


Read array data from 
block other than that 
being erased. 


Erase Resume | Data = DOH 


Figure 11. 28F001BX Erase Suspend/Resume Flowchart 


- Programming Equipment 


For PROM programming equipment that cannot 
bring RP# to high voltage, OE # provides an alter- 
nate boot block access mechanism. OE # must tran- 
sition to Vu a minimum of 480 ns before the initial 
program/erase setup command and held at Vyp at 
least 480 ns after program or erase confirm com- 
mands are issued to the device. After this interval, 
OE# can return to normal TTL levels. 


DESIGN CONSIDERATIONS 
Three-Line Output Control 


Flash memories are often used in larger memory ar- 
rays. Intel provides three control inputs to accommo- 
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date multiple memory connections. Three-line con- 
trol provides for: 


a) lowest possible memory power dissipation 


b) complete assurance that data bus contention will 
not occur 


To efficiently use these control inputs, an address 
decoder should enable CE#, while OE # should be 
connected to all memory devices and the system’s 
READ # control line. This assures that only selected 
memory devices have active outputs while deselect- 
ed memory devices are in Standby Mode. RP# 
should be connected to the system POWERGOOD 
signal to prevent unintended writes during system 
power transitions. POWERGOOD should also toggle 
during system reset. 
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Power Supply Decoupling 


Flash memory power switching characteristics re- 
quire careful device coupling. System designers are 
interested in 3 supply current issues; standby current 
levels (Isp), active current levels (icc) and transient 
peaks producted by falling and rising edges of CE#. 
Transient current magnitudes depend on the device 
outputs’ capacitive and inductive loading. Two-line 
control and proper decoupling capacitor selection 
will suppress transient voltage peaks. Each device 
should have a 0.1 wF ceramic capacitor connected 
between its Vcc and GND, and between its Vpp and 
GND. These high frequency, low inherent-induc- 
tance capacitors should be placed as close as pos- 
sible to the device. Additionally, for every 8 devices, 
a 4.7 wF electrolytic capacitor should be placed at 
the array’s power supply connection between Voc 
and GND. The bulk capacitor will overcome voltage 
slumps caused by PC board trace inductances. 


Vpp Trace on Printed Circuit Boards 


Programming flash memories, while they reside in 
the target system, requires that the printed circuit 
board designer pay attention to the Vpp power sup- 
ply trace. The Vpp pin supplies the memory cell cur- 
rent for programming. Use similar trace widths and 
layout considerations given to the Vcc power bus. 
Adequate Vpp supply traces and decoupling will de- 
crease Vpp voltage spikes and overshoots. 


Vcc: Vpp, RP # Transitions and the 
Command/Status Registers 


Programming and erase completion are not guaran- 
teed if Vpp drops below Vppx. If the Vpp Status bit of 
the Status Register (SR.3) is set to “1”, a Clear 
Status Register command MUST be issued before 
further program/erase attempts are allowed by the 
WSM. Otherwise, the Program (SR.4) or Erase 
(SR.5) Status bits of the Status Register will be set 
to “1” if error is detected. RP# transitions to Vi, 
during program and erase also abort the operations. 
Data is partially altered in either case, and the com- 
mand sequence must be repeated after normal op- 
eration is restored. Device poweroff, or RP# tran- 
sitions to Vj_, clear the Status Register to initial val- 
ue 80H. 


The Command Register latches commands as is- 
sued by system software and is not altered by Vpp 
or CE# transitions or WSM actions. Its state upon 
powerup, after exit from Deep-Powerdown or after 
Vcc transitions below V. Ko, is FFH, or Read Array 
Mode. 
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After program or erase is complete, even after Vpp 
transitions down to Vpp,, the Command Register 
must be reset to read array mode via the Read Array 
command if access to the memory array is desired. 


Power Up/Down Protection 


The 28F001BX is designed to offer protection 
against accidental erasure or programming during 
power transitions. Upon power-up, the 28F001BxX is 
indifferent as to which power supply, Vpp or Vcc, 
powers up first. Power supply sequencing is not re- 
quired. Internal circuitry in the 28F001BX ensures 
that the Command Register is reset to Read Array 
mode on power up. 


A system designer must guard against spurious 
writes for Vcc voltages above Vixo when Vpp is 
active. Since both WE# and CE# must be low for a 
command write, driving either to Vjy will inhibit 
writes. The Command Register architecture provides 
an added level of protection since alteration of mem- 
ory contents only occurs after successful completion 
of the two-step command sequences. 


Finally, the device is disabled, until RP # is brought 
to Viy, regardless of the state of its control inputs. 
This provides an additional level of protection. 


28F001BX Power Dissipation 


When designing portable systems, designers must 
consider battery power consumption not only during 
device operation, but also for data retention during 
system idle time. Flash nonvolatility increases us- 
able battery life because the 28F001BX does not 
consume any power to retain code or data when the 
system is off. 


In addition, the 28F001BX’s Deep-Powerdown mode 
ensures extremely low power dissipation even when 
system power is applied. For example, laptop and 
other PC applications, after copying BIOS to DRAM, 
can lower RP# to Vj,, producing negligible power 
consumption. If access to the boot code is again 
needed, as in case of a system RESET *#, the part 
can again be accessed, following the tpy~ay wakeup 
cycle required after RP# is first raised back to Vjy. 
The first address presented to the device while in 
powerdown requires time tpya~y, after RP# tran- 
sitions high, before outputs are valid. Further ac- 
cesses follow normal timing. See AC Characteris- 
tics—Read-Only Operations and Figure 12 for more 
information. 
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ABSOLUTE MAXIMUM RATINGS* 


Operating Temperature 


Dr st@ad ook «3 oc wth cok Baas 0°C to 70°C(1) 

During Erase/Program ........... 0°C to 70°C(1) 
Operating Temperature 

DUNG PISO fivacccdestsdaus — 40°C to + 85°C(2) 

During Erase/Program ...... — 40°C to + 85°C (2) 
Temperature under Bias ......... — 10°C to 80°C(1) 
Temperature under Bias ....... — 20°C to + 90°C(2) 
Storage Temperature............. ~65°C to 125°C 


Voltage on Any Pin 
(except Ag, RP#, OE#, Voc and Vpp) 


_ with Respect to GND .......... —2.0V to 7.0V(3) 
Voltage on Ag, RP#, and OE# 
with Respect toGND ....... —2.0V to 13.5V(S; 4) 


Vpp Program Voltage 
with Respect to GND 


During Erase/Program...... —2.0V to 14.0V(S, 4) 
Vcc Supply Voltage 

with Respect toGND .......... —2.0V to 7.0V(3) 
Output Short Circuit Current............. 100 mA(5) 
NOTES: 


* WARNING: Stressing the device beyond the “Absolute 
Maximum Ratings’’ may cause permanent damage. 
These are stress ratings only. Operation beyond the 
“Operating Conditions’ is not recommended and ex- 
tended exposure beyond the “Operating Conditions” 
may affect device reliability. 


1. Operating temperature is for commercial product defined by this specification. 

2. Operating temperature is for extended temperature product defined by this specification. 

3. Minimum DC voltage is —0.5V on input/output pins. During transitions, this level may undershoot to —2.0V for periods 
<20 ns. Maximum DC voltage on input/output pins is Voc +0.5V which, during transitions, may overshoot to Vcc + 2.0V 


for periods <20 ns. 


4. Maximum DC voltage on Ag or Vpp may overshoot to + 14.0V for periods <20 ns. 
5. Output shorted for no more than one second. No more than one output shorted at a time. 


OPERATING CONDITIONS 


| Symbol | Parameter 
Operating Temperature(2) 
4.50 


Input Load Current 1 


lccs 
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Test Conditions 


Voc = Voc Max 
Vin = Voc or GND 


Voc = Vcc Max 
Vout = Vcc or GND 


Voc = Vcc Max 
CE# = RP# = Vin 


vA | Voc = Voc Max 
CE# = RP# = Voc +0.2V 
R 


1.0 P# = GND +0.2V 
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Symbol] Parameter Twin [rye] wax [unit] Test Conaions 


f = 8 MHz, lout = OMA 
8 
loce__|VocEraseCurent | 1 | | 6 | 20 |mAlErasein Progress 


Icces |Vcc Erase Suspend Current he mA |Erase Suspended 
CE# = Vip 
[20] 200 [wave >Voo 


fepo [Vee Deep-PowerdownGurent | 1 | loaol 10 [ua 


Vpp Programming Current 1 6 30 mA |Vpp = Vppy 
Programming in Progress 
Vpp Erase Current 1 30 mA |Vpp = Vppy 
Erase in Progress 
Vpp Erase Suspend Current 1 300 A |Vpp = VppyH 
Erase Suspended 


Mu [mnputtowvonago | —(-osl [os [v[ 
in [nputrignvotage | [20 [ecroslv[ SS 


VoL Output Low Voltage 0.45 V |Voc = Vcc Min 
lo. = 5.8 mA 

VoH _ |Output High Voltage 2.4 V |Voc = Vec Min 
lon = 2.5mMA 


Nip [Avinteligontdentter Vonage | [vs [ao [v[ 
Veen [Vee during Prog/Erase Operations] | vafiaal rae [v[ 

, lee fs ee ae eae 
[Tal [126 | v [eco Bicck Progreso 


Input Load Current 1 Voc = Vcc Max 
Vin = Voc or GND 


+10 py Voc = Voc Max 
Vout = Vcc or GND 


Output Leakage Current 


Vcc Standby Current Voc = Voc Max 
CE# = RP# = Vip 
Voc = Voc Max 
CE# = RP# = Vcc +0.2V 
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DC CHARACTERISTICS Vcc = 5.0V +10%, Ta = —40°C to + 85°C (Continued) 


‘win [Tye] Max [Unt] Test Gonalions 
ee 
f = 8 MHz, lout = OMA 
lccp _|Vcc Programming Current 1 | | 5 | 20 _|mA|Programmingin Progress 
Re a EC Ne 


Ilcces |Vcc Erase Suspend Current 1,2 mA |Erase Suspended 
CE# = Vin 


St ane eee re 
Teo] 200 ple Weg ta 
lepo Nop DeopPowerdownGurent | 1 | [osol 10 [yanP# = GND z02v 


Vpp Programming Current 1 BLA |Vpp = Vppy 
Programming in Progress 
Vpp Erase Current 1 mA |Vpp = VppH 
Erase in Progress 
Vpp Erase Suspend Current 1 400 pA |Vpp = Vppy 


Ag Intelligent Identifier Current 
IL Input Low Voltage 
1H Input High Voltage 


OL Output Low Voltage 
OH  |Output High Voltage 


: 


HH RP #, OE# Unlock Voltage 


Parameter 


Voc Deep-Powerdown Current 
Voc Read Current 


QO |O 
10 


Erase Suspended 


or 
V 


0.45 V Voc = Vec Min 
lo. = 5.8mA 


Voc = Vcc Min 
lon = 2.5 mA 


m rh 
= rs 


Boot Block Prog/Erase 


BBE 

no 

=) 
teleieiay <1 Stel< 


Symbol 
Input Capacitance 
Output Capacitance 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Voc = 5.0V, Vpp = 12.0V, Ta = 25°C. These currents 
are valid for all product versions (packages and speeds). 

2. Ioces is specified with the device deselected. If the 28F001BX is read while in Erase Suspend mode, current draw is the 
sum of Icces and Iccr. 

3. Erase/Programs are inhibited when Vpp = Vpp, and not guaranteed in the range between Vppy and Vpp,. 

4. Sampled, not 100% tested. 
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AC INPUT/OUTPUT REFERENCE WAVEFORM 


2.4 
x 2.0 % 2.0 
INPUT TEST POINT 
ie ii he, OINTS <—_ 9g OUTPUT 


290406-10 
A.C. test inputs are driven at Voy (2.4 Vrtz,) for a Logic “1” and Vo, (0.45 
VttU for a Logic “0”. Input timing begins at Viy (2.0 Vr7_) and Vy, (0.8 
VttL). Output timing ends at Vi and Vj,. Input rise and fall times (10% to 
90%) < 10 ns. 


AC CHARACTERISTICS—Read-Only Operations(1) 


E28F001BX-120 
N28F001BX-120 
P28F001BX-120 


Output Hold from 
Addresses, CE # or OE # 
Change, Whichever is First 


NOTES: 
1. See AC Input/Output Reference Waveform for timing measurements. 
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AC TESTING LOAD CIRCUIT 


290406-11 
C. = 100 pF 
C,. Includes Jig Capacitance 
R_ = 3.3 kn 


E28F001BX-150 
TE28F001BX-150 
N28F001BX-150 
TN28F001BX-150 
P28F001BX-150 


2. Model Number Prefixes: E = TSOP (Standard Pinout), N = PLCC, P = PDIP, T = Extended Temperature. 
3. OE# may be delayed up to tce-tog after the falling edge of CE # without impact on tce. 


4. Sampled, not 100% tested. 


4-197 


861-7 


SUOI}E19dO Pedy 10} WIOJ9ARM OV “Z} aunbi4 


DEVICE AND 
Voc POWER-UP STANDBY ADDRESS SELECTION OUTPUTS ENABLED 


— 


RP# (P) 


Vib 


DATA VALID 


VALID OUTPUT 


STANDBY Vcc POWER-DOWN 


WAYAVAVAYAY 
AXAAXAK 


— &-X8100482/1-X81 00482 
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AC CHARACTERISTICS—Write/Erase/Program Operations(!, 9) 


Voc + 10% 28F001BX-120 | 28F001BX-150 


100 


ora 
s 
eas 
se 
al 
san [twen | WE Puce Width High i 

[ [Duration of Programming Operon [6.87 
Iucve| | Duration of Erase Operation Goo) [8.6.7 

[owas 


Duration of Erase Operation (Parameter) 


oak =e oe =a/2_/- 
o;on 


N 
on 


ru 


— | ae ee es ae 
G@ | O1 Oo ;1oO i@ 
ES 


N 
mike 
{ee 


N 


—_ 
ie) 


‘wricva| | Duration of Erase Operation (Main) | 5.6, 7 | 

| __|Write Recovery beforeRead | 
tovPH__| 'PHH mf 
fever | [BootBlockRelockDelay | 


tcnnm| | OE# Van Setup toWE# Goinglow | 2,8 
twncn | [OE# Via Hold romWe* High | 2.8 
NOTES: 


1. Read timing characteristics during erase and program operations are the same as during read-only operations. Refer to 
AC Characteristics for Read-Only Operations. 
2. Sampled, not 100% tested. 

3. Refer to Table 3 for valid Ajj for byte programming or block erasure. 

4. Refer to Table 3 for valid Dixy for byte programming or block erasure. 

5. The on-chip Write State Machine incorporates all program and erase system functions and overhead of standard Intel 
Flash Memory, including byte program and verify (programming) and block precondition, precondition verify, erase and erase 
verify (erasing). 

6. Program and erase durations are measured to completion (SR.7 = 1). Vpp should be held at Vppy until determination of 
program/erase success (SR.3/4/5 = 0). 

7. For boot block programming and erasure, RP# should be held at Vy until determination of program/erase success 
(SR.3/4/5 = 0). 

8. Alternate boot block access method. 

9. Erase/Program Cycles on extended temperature products is 10,000 cycles. 
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ERASE AND PROGRAMMING PERFORMANCE 


p ‘ an 28F001BX-120 
arameter otes 
Typ(1) 


[Boot Bock Eresotine | 2 
[Boot Bock Progam Tine | 2 | 
[Parameter lock Erase Tine | 2 
[Parameter Block Program Tine | 2 
[Main Blok EreoTime | 2 
[Main Block ProgamTime | 2 
Toripcreeo Tine |e 
[crip ProgramTine «ite 


NOTES: 
1. 25°C, 12.0 Vpp. 
2. Excludes System-Level Overhead. 
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a 
Oo 
a 
a 
= 
= 
Oo 


. 
. 


Chip Program Time (Sec) 


mo 12V; 10 ke; 23 
11.4V; 10 ke: 70C 
nem 12V; 100 ke; 23C 
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Figure 13. 28F001BX Typical Programming Capability 


PEEP EAE 
SUE TE EEET 
BGAN 2A2 1aRRe 
J 
7 
Leer ey 


CHIP PROGRAM TIME SEC 


: , / 
4 , y, 


POO AT 
erp het et | | | | 


Geo 
0 10 20 30 40 50 60 70 80 90 100 110 120 130 


TEMP (C) 


ommmee 1k Cycles 
--=-- 10k Cycles 
— - — 100k Cycles 
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Figure 14. 28F001BX Typical Programming Time at 12V 
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A 
a a 4 “ACNE 


ae ae ae Ss ea 
Oe Be Sales A AS OS eS ee 
Eo see ee 


tt A 
PW es SORBET Cte So 


Coy 
Jeet bol LED ara J 


CUM . PROB . 


MAIN BLOCK ERASE TIME (SEC) 


os §=— 1 2V 5 10 ko; 23C 
oommeames 11.4V; 10 ke; OC 


2V¥; 100 kes 235C 
ee ee 290406-21 


‘ 
\ 


| NC 


MAIN BLOCK ERASE TIME SEC 


10 20 30 40 50 60 70 80 90 100 110 120 130 140 
TEMP (°C) 


ems {k Cycles 
-=-=-- 10k Cycles 
— - — 100k Cycles 
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Figure 16. 28F001BX Typical Erase Time at 12V 
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Veco POWER-UP WRITE PROGRAM OR 


WRITE 
© STANDBY ERASE SETUP COMMAND VALID ADDRESS & DATA (PROGRAM) 


AUTOMATED PROGRAM READ STATUS WRITE READ ARRAY 
OR ERASE CONFIRM COMMAND COMMAND 


ela Vin XXX) WOOO OO N' y XA KAA) | (KA) 
eR, ED, GLI isislsy, Nuun toouuuuune 


IVV NA 


tWHEH 


tWHGL 


pa | twHov1,2,3,4 
tpvWH 


DATA (D/Q) Mh VALID \\\ 
\\\ SRD Mh, 


IXXXKKAKXK XA) 
$EEXNOXX 
ESR 


XY) rare 


Y Ne 


x 4 
Oy 


Wrens 
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WRITE 
VALID ADDRESS AND DATA (PROGRAM) 
OR ERASE CONFIRM COMMAND 


AUTOMATED PROGRAM READ STATUS 
OR ERASE DELAY REGISTER DATA 


WRITE PROGRAM OR 
ERASE SETUP COMMAND 


VHH 


OE# (G) Vin Oe fe 


VALID 
ns "mene i ee 
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Figure 18. Alternate Boot Block Access Method Using OE # 
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ALTERNATE CE#-CONTROLLED WRITES() : 
28F001BX-120 | 28F001BX-150 
Parameter Notes 
taVAV Write Cycle Time 

tpHe. | tps | RP# High Recovery to CE# Going Low 
tWLEL WE # Setup to CE# Going low 

teLes CE # Pulse Width 

tpHHEH tps. RP# VupH Setup to CE# Going High 
tyPEH Vpp Setup to CE# Going High 

taVEH Address Setup to CE # Going High 
Data Setup to CE # Going High 


tEHDx tH Data Hold from CE # High 


tEHAX Address Hold from CE # High 
teHwH | twH | WE# Hold from CE# High 


tepy | CE# Pulse Width High 
Duration of Programming Operation 


< 
@ 
=| 
_ 
° 
S| 
7 


53 > 
ol 


2 


Duration of Erase Operation (Boot) 
Duration of Erase Operation (Parameter) 
Duration of Erase Operation (Main) 
Write Recovery before Read 

Vpp Hold from Valid SRD 

RP # Vu Hold from Valid SRD 
Boot-Block Relock Delay 


PROM Programmer Specifications 


Toymbot[ Parameter =| Notes | win | Max [| Min 
‘tenner [OE Vin Setup toCE* Gongiow | 2.7 | 400 | | 480 
tenon [ OF# Vin HoldtomGE@ High [2.7 | #00 | | 480 


NOTES: 

1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of CE# and WE#. In systems where 
CE# defines the write pulse width (within a longer WE# timing waveform), all set-up, hold and inactive WE# times should 
be measured relative to the CE# waveform. 

2. Sampled, not 100% tested. 

3. Refer to Table 3 for valid Ajy for byte programming or block erasure. 

4. Refer to Table 3 for valid Diy for byte programming or block erasure. 

5. Program and erase durations are measured to completion (SR.7 = 1). Vpp should be held at Vppy, until determination of 
program/erase success (SR.3/4/5 = 0). ! 

6. For boot block programming and erasure, RP# should be held at Vy until determination of program/erase success 
(SR.3/4/5 = 0). 

7. Alternate boot block access method. 
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é WRITE 
ee STANDBY ERASE SETUP COMMAND VALID ADDRESS & DATA (PROGRAM) —“OR'ERASe DELAY REGISTER DATA COMMAND 
Vin ; 
C00 ae ee? IXXKKAAKAMYZAXAAAXAAA ALARA AAA AAA 
aporesses (a) XXX XM s A OO XXX XR KAKA ARK KKM KK 
Vit XK x : ; \X XX XX OO YOXKAK XXX A, YOY 
tavav tAVEH tEHAX | 
Vii 
WE# (W) 
‘ tWLeL : teHWH te 
a HGL 
OE# (G) 
Vit 
teHav1,2,3,4 
Vin 
CE# (E) 
Mt =) 
‘oven 
V 
wo EG) EY 
Sos aE NE //, 
tPHHEH tovPH 
VHH ne a rn en he RS i Ee Sa eS ee ee 
/ \ 


AXXXXXKXXXX YY XY) AAA 
ORK KK KRY 
/\ XX XX XXX XXX (x /\ XX? XX a 


RP# (P) a : 
z ee a ‘vv 
digg XO Xe XXX xx 
wom BAX ERNN 
KY 


POO Ono ROK 
Vn INIVVVVVVVVY VV VY VV VAVAVAVAVAVAVAVAVAVAVAVAY, 
BERR ARR RRR 


IL 
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ORDERING INFORMATION 

Tlefafefr jojo} sje} x]-[r] sf2fo| 


PACKAGE [ ACCESS SPEED (ns) 


E STANDARD 32 LEAD TSOP 1706 
N 32 LEAD PLCC 150ns 
P 32-PIN PLASTIC DIP 
T TOP BOOT DEVICE 
TEMPERATURE RANGE B BOTTOM BOOT DEVICE 
T= EXTENDED (-40°C to +85°C) 


BLANK = COMMERCIAL (0°C to +70°C) 
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VALID COMBINATIONS: 

E28F001BX-T120 N28FO01BX-T120 P28F001BX-T120 
E28F001BX-T150 N28FO01BX-T150 P28F001BX-T150 
TE28F001BX-T150 TN28F001BX-T150 


E28F001BX-B120 N28F001BX-B120 P28F001BX-B120 
E28F001BX-B150 N28F001BX-B150 P28F001BX-B150 
TE28F001BX-B150 TN28F001BX-B150 . 


ADDITIONAL INFORMATION 


Order Order 
Number Number 
ER-20 “ETOX II Flash Memory 294005 AP-316 ‘Using Flash Memory for In- 292046 
Technology” System Reprogrammable 4 
RR-60 “ETOX I Flash Memory Reliability 293002 Nonvolatile Storage” 
Data Summary” AP-341 ‘Designing an Updatable BIOS 292077 
Using Flash Memory” 


REVISION HISTORY 


| Number | Description 


Removed Preliminary classification. 
Latched address Aj¢ in Figure 5. 


Updated Boot Block Program and Erase section: “If boot block program or erase is attempted 
while RP # is at Vij, either the Program Status or Erase Status bit will be set to “1”, 
reflective of the operation being attempted and indicating boot block lock.” 


Updated Figure 11, 28F001BX Erase Suspend/Resume Flowchart 
Added DC Characteristics typical current values 


Combined Vpp Standby current and Vpp Read current into one Vpp Standby current spec with 
two test conditions (DC Characteristics table) 


Added maximum program/erase times to Erase and Programming Performance table. 
Added Figures 13-16 
Added Extended Temperature proliferations 


PWD changed to RP# for JEDEC standardization compatibility 
Revised symbols, i.e.; CE, OE, etc. to CE#, OE#, etc. 
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Designing an Updatable BIOS Using Flash Memory 
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1.0 INTRODUCTION 


As PC computing platforms increase in complexity, so 
does the associated BIOS code. Sophisticated hardware 
and BIOS software increase the potential for revisions. 
Time-to-market goals require faster completion of de- 
signs from conception to production, leaving less time 
for new-peripheral BIOS support. As an example, 
many 80286-based PC/ATs lack BIOS support for 
34," floppy drives! Once a computer is out the door, 
code revisions are far more difficult and costly. Code 
revisions with EPROM require either a service call or 
sending EPROMs to the end user, assuming nothing 
else goes wrong in the process. The alternative to BIOS 
update is a prematurely obsolete system, unable to sup- 
port new industry standards and peripheral systems. 


Flash memory offers the same nonvolatile storage as 
EPROM, but additionally offers in-system write capa- 
bility. Using Intel’s 28FO01BX for BIOS storage, code 
updates are done quickly in the factory during test and 
debug, while allowing cost-effective field updates to end 
users via floppy disks or modem BBS. 


This application note describes various methods of im- 
plementing a flash memory BIOS using the 28F001BX. 
Design targets are both laptop and desktop systems. 
The primary emphasis is on application of flash memo- 
ry for BIOS and ROM executable software applica- 
tions. Detailed 28F001BX information is covered in the 
datasheet, available through your local sales office. 


2.0 FLASH MEMORY 


This section provides a brief overview of Intel’s Flash 
Memory and in particular, Intel’s 28FO01BX blocked 
flash memory family. It covers the following: 


e Flash memory’s EPROM roots 
e Program and Erase Automation 
© Blocked Architecture 

© Deep Powerdown Mode 


e Pinouts, physical layout and upgrade for different 
packages 


© Vpp specifications 


Major features of the 28FOO1BX are in-system write, 
selective block erase, program/erase automation, 
SRAM-like command interface, deep powerdown capa- 
bility, fixed Vcc and Vpp supplies and hardware lock- 
out protection. 


2.1 EPROM Roots; Review of Flash 
Process vs EPROM & EEPROM 


Intel’s ETOX II (EPROM Tunnel OXide) flash memo- 
ry is a Single-transistor cell providing nonvolatile 
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storage like EPROM, with electrical erase similar to 
EEPROM. Reprogramming flash memory entails elec- 
trically erasing all data bits in parallel, then randomly 
programming data into any byte in the array. The pro- 
gramming operation is achieved via channel hot elec- 
tron injection (CHE), just like EPROMs. Flash electri- 
cal erasure, however, is accomplished through Fowler- 
Nordheim (FN) tunneling. Using separate program and 
erase methods (CHE vs. FN Tunneling), in different 
cell locations, drain vs. source, permits process opti- 
mization for high cycling endurance—the number of 
complete erase and re-writes. Traditional low-density 
EEPROMs tunnel through the same memory cell junc- 
tion for both programming and erasure. Because 
EEPROMS erase before programming each byte, these 
processes must occur very fast. Therefore, internal volt- 
ages used to program or erase 5V-only EEPROM 
memory cells are high (e.g., 18V—30V). The combina- 
tion of higher voltage with programming and erasing 
through the same junction contributes to EEPROM’s 
oxide breakdown, poor data retention and reduced cy- 
cling capability. 


Intel’s flash memory erasure (tunneling) voltage is be- 
low the critical oxide breakdown voltage. By using 
block erasure instead of EEPROM’s byte erasure, erase 
times are relaxed, reducing tunneling voltages. Pro- 
gramming Intel’s Flash Memory is non-destructive to 
the floating gate oxide compared to EEPROM’s use of 
tunneling for programming. These features for erase 
and programming provide Intel’s Flash Memory with 
the highest endurance (typically over 100K cycles) 
compared to that of traditional EEPROM cycling. Fur- 
thermore, flash memory exhibits lower failure rates at 
any given cycle count. 


2.2 Program and Erase Automation 


The 28FOOIBX integrates a Write State Machine 
(WSM) on-chip to internally implement program and 
erase algorithms. Operations are initiated through com- 
mand sequence writes to the Command Register, and 
progress is reported back to the user through Status 
Register bits. Software timers are no longer required, as 
timing is now regulated through the on-chip oscillator. 
System software requirements are decreased in compar- 
ison to past algorithms, minimizing overhead and de- 
velopment effort, and allowing code execution and in- 
terrupt servicing while simultaneously programming or 
erasing the device. 


The Erase Suspend command halts block erase to exe- 
cute code or read data from any other block. This fea- 
ture gives the system the capability to service higher 
level interrupts requiring data from the 28F001BX dur- 
ing the erase interval. After issuing the Erase Resume 
command, the WSM continues erase where it left off 
when suspended. 
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112 Kbyte MAIN BLOCK 


4 Kbyte PARAMETER BLOCK 
4 Kbyte PARAMETER BLOCK 


8 Kbyte BOOT BLOCK 


28F001BX-B 


Figure 1. 28F001BX Memory Maps 


2.3 Blocked Architecture 


The 28F001BX family combines the safety of a hard- 
ware-protected 8 Kbyte “boot” block with the flexibili- 
ty of two 4 Kbyte “parameter” blocks and one 
112 Kbyte main block. Each block can be individually 
erased and programmed without affecting code stored 
in another block, ensuring data integrity. The boot 
block is intended to contain secure code which mini- 
mally will bring up the system and download code to 
the other blocks of the 28F0O01BX if required. Once 
programmed, it is hardware-locked from further altera- 
tion, guaranteeing true non-volatility. 


The 28FO01BX-T’s lockable block location provides 
compatibility with microprocessors and microcontrol- 
lers that boot from the top of the memory map, such as 
many of Intel’s microprocessor families. The seg- 


mentation of the 28F001BX-B is identical. Its lockable 
block location provides compatibility with microproc- 
essors that boot from low memory, such as Motorola 
and AMD products. See Figure 1 for illustrations of the 
two memory maps available in the 28FO01BX family. 


The two 4 Kbyte parameter blocks have multiple uses 
in BIOS environments. They can be used to back up the 
CMOS setup parameters such as floppy and hard disk 
type, processor speed, system memory size, graphic dis- 
play type and presence of a coprocessor. Today, should 
the system battery fail, the user loses information in 
battery-backed SRAM. The non-volatile parameter 
blocks provide the system capability to automatically 
back up and recover this information. Also, EISA sys- 
tems can store software variable information such as 
add-in board addresses, DMA channels and interrupt 
values/levels. 
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P28F001BX 
32-PIN PDIP 
0.62" x 1.64" 


TOP VIEW 
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Figure 2. 28F001BX DIP Pin Configuration 


2.4 Deep Powerdown Mode 


Market analysts predict that the high-growth segments 
of the PC industry for the next several years will be in 
the laptop, palmtop and handheld product lines. Power 
management software is becoming an integral part of 
PC system BIOS as manufacturers attempt to squeeze 
the maximum amount of system operation time from 
their battery pack power supplies. A key indicator of 
this trend is Intel’s i386T™MSL microprocessor superset, 
which adds hardware power management to the Intel 
386 architecture and answers the needs of low-power 
applications. 
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The 28F001BX family features deep powerdown capa- 
bility and is ideally suited for these same battery-oper- 
ated systems. Powerdown is entered through low volt- 
age on the RP# pin. Typical power consumption 
through Vcc in powerdown is 0.25 wW, regardless of 
power supply voltages and activity on the external bus. 
Once BIOS is shadowed to system DRAM for high- 
speed execution, the 28FO01BX can be shut down for 
minimal current drain. 


This same pin, with 12V present on it, gates program 
and erase of the boot block. Such a hardware lockout 
preserves the system boot code once initially pro- 
grammed and protects it from inadvertent alteration or 
computer virus compromise. 


28F010 


28F001BX (128Kx8) 
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Figure 3. 28F001BX PLCC Lead Configuration 


2.5 28F001BX Pinouts, Physical 
Layout and Upgrade 


Intel’s 28FO01BX is offered in three standard 32-pin 
packages: Plastic Dual In-line Package (PDIP), Plastic 
Leaded Chip Carrier (PLCC), and Thin Small Outline 
Package (TSOP). All three pinouts provide backward 
compatibility with Intel’s 28F010 bulk-erase flash. See 
Figures 2, 3, and 4 for pinout details. 


Plastic Dual In-Line Package 


PDIPs with sockets provide an excellent way to proto- 
type and debug new designs. The 28FO01BX is back- 
ward pin-compatible with 1 Mbit standard flash and 
EPROMs. 


Plastic Leaded Chip Carrier 


Most system designs today require surface mount tech- 
nology (SMT) due to shrinking board real estate and 
portable form factors. PLCC is one SMT component 
that uses as little as 35% of the overall board space 
compared to PDIP. Its small size is attributed to the 
center-to-center lead spacing of 50 mils versus 100 mils, 
as well as its four-sided pinout. The J-lead design allows 
the PLCC to be directly soldered to the circuit board. 
Most SMT manufacturing equipment can easily handle 
the PLCC’s 50-mil lead pitch. PLCC SMT sockets such 
as that offered by AMP (P/N 821977-1) have an identi- 
cal foot-print for 32-pin devices. Such sockets can be 
used in place of directly soldering a PLCC for proto- 
type build and code testing. Once the reprogramming 
code is tested and debugged, flash PLCCs can then be 
surface-mounted without socketing during production 
runs. 
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Thin Small Outline Package 


TSOP is the package of choice for hand-held equipment 
or palmtop/laptop computers. These compact systems 
require minimal height and area for all components, for 
which TSOP excels. TSOP height measures 1.2mm ver- 
sus 3.5mm for PLCC. TSOP area is 8mm x 20mm com- 
pared to PLCC’s 11.43mm x 13.97mm. Therefore, 
TSOP has significantly less total volume: TSOP = 
172.8mm3, while PLCC = 656.3mm3, and DIP = 
1872.3mm3. State-of-the-art center-to-center terminal 
spacing of 20 mils yields a smaller package with nar- 
rower conductor traces than PLCC or PDIP. Location 


28F010 


Intel. 


of pins on both ends of the package allows traces for 
TSOP to be routed underneath the chip, reducing 
board layers. TSOP for the 28F001BX is available in 
the standard (E) pin configuration. For multiple chip 
flash systems, Intel’s bulk-erase 28FO10 flash memory 
is available in both standard (E) and reverse (F) pin 
configurations (see Figure 5) allowing components to 
be laid out end-to-end and side-to-side for highest 
board density (see Figure 6). Note how pins 32-17 on 
the standard pinout match pins 1-16 on the reverse 
pinout, and how pins 1-16 on the standard pinout 
match pins 32-17 on the reverse pinouts. 


28F010 


E28F001BX 


52 LEAD TSOP 
8mm x 20mm 
TOP VIEW 
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Figure 4. 28F001BX TSOP Lead Configuration 
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Figure 5. 28F010 Standard and Reverse TSOP Lead Configurations 
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Figure 6. 28F001BX and 28F010’s in Serpentine Layout Using TSOPs 


2.6 Vpp Specifications 


Fixed Vpp and Vcc 


Flash memories, like EPROMs, require a 12V pro- 
gramming power supply. Unlike EPROMs, however, 
the Vpp for flash memory is a fixed, standard level. 
When combined with the Command Register 
erase/program control, Intel flash memories use a sim- 
ple, SRAM -like hardware interface with standard mi- 
croprocessor timings. 


Intel’s Flash Memory Vpp specification is 12.0V 
+0.6V (5%), compatible with most off-the-shelf sys- 
tem power supplies. The IBM PC technical reference 
manual specifies the 12V power supply at 12.0V, +5% 
and —4%. Additionally, some hard and floppy drives 
require 12V +5%. Therefore, most PC power supplies 
have 12V supplies with +5% or better tolerance. Possi- 
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ble exceptions to this are laptop and/or palmtop PCs. 
Some of these require 5V-only designs, in which case 
5V is charge-pumped to 12V. It is essential to use the 
specified Vpp when programming and erasing flash. 
Once the commands to program or erase are issued, the 
device internally derives the required voltage references 
from the Vpp supply. Therefore, an improper Vpp level 
degrades the performance of the part. 


The Write State Machine automatically monitors the 
voltage present on the Vpp pin, beginning when pro- 
gram or erase setup commands are issued and continu- 
ing throughout the internal algorithm interval. If low 
Vpp is detected, the WSM automatically aborts the 
program or erase attempt and reports an improper volt- 
age error to the user through the Status Register. The 
hardware design section discusses various methods of 


: Vpp generator if your 12V power supply does not meet 


the proper tolerances or 12V is not available. 


t *. % * 
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RP#, Vcc and Vpp Lockout Protection 


The RP # (Resert/Powerdown) pin provides hardware 
write protection for 28FOO1BX flash memories. Until 
this pin transitions to TTL-level Vy4y, write attempts to 
the device Command Register are ignored, regardless 
of power supply levels or activity on the system bus and 
control inputs. Typically, the system designer will gate 
this signal with a system POWER GOOD indicator 
output to ensure system stability before memory access- 
es begin. 


The 28FO01BX family provides additional protection 
for designs that tie 12V directly to the device. Since the 
12V supply is less capacitively loaded than the 5V sup- 
ply, the 12V power supply reaches full value faster dur- 
ing power-on. If Command Register lockout protection 
was not provided, a finite possibility exists that inadver- 
tent writes may occur during power-on. For this case, 
Intel’s 28FO01BX flash memory supplies Command 
Register lockout protection when Vcc is below 2.5V, 
preventing writes to flash memory from occurring. 
Since CMOS logic is valid at 2.0V, a 0.5V margin of 
protection exists, providing extra time for control sig- 
nals to settle before the Command Register is activated. 
Program/erase inhibit is guaranteed with Vpp below 
6.5V, with corresponding Vpp low reported through 
the Status Register. Once Vcc reaches 2.5V, the Com- 
mand Register begins processing valid commands, and 
program/erase attempts may initiate with Vpp greater 
than 6.5V. At this point, the system is responsible for 
write control. 


When the 28FO01BX Vcc powers up, or after the RP # 
pin transitions to Vy; and back to Vyy, the Command 
Register is automatically initialized to Read Array 
mode. 
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3.0 HARDWARE DESIGN 
CONSIDERATIONS 


The system level hardware requirements for imple- 
menting BIOS and application storage in flash are: 


® Write Enable available to all of the flash memory 
@ 12V routed to flash location or generated on-board 


¢ CMOS control-signal interface, or RP# gated by a 
power-good signal 


e Data buffer or transceiver that works in both write 
and read directions 


¢ Space in memory map allocated for each applica- 
tion’s size 


Intel’s 1386SL microprocessor superset was chosen for 
the design example, shown in Figure 7. The Intel386SL 
microprocessor superset integrates all major compo- 
nents of a Intel386 based design on two chips, including 
bus memory, cache controllers and the ISA peripheral 
subsystem. Additionally, it consolidates hardware pow- 
er management for battery-operated designs such as 
laptop, handheld and palmtop computers. 


Note the clean interface between the superset and 
28F001BX-T. Flash memory was comprehended early 
in the design of the Intel386SL microprocessor super- 
set, to ensure a minimal-chip interface. Transceivers for 
the system bus, as well as a flash memory CE# signal, 
are integrated on the Intel386SL. 
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Figure 7. Intel386SL Microprocessor Superset with 28F001BX-T Flash BIOS 
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The RP# pin is gated by a power good signal to ensure 
control logic integrity before writes to the 28F001BX-T 
are allowed. It is also gated by System Reset, to abort 
program or erase if required for CPU reboot, and by a 
separate General Purpose Input-Output (GPIO) line to 
power down the device once BIOS is shadowed to 
RAM. CMOS logic will guarantee lowest power dissi- 
pation. 


Similarly, system 12V is gated both by System Reset 
and a GPIO line. Software can switch 12V to the 
28F001BX-T only when programming or erasing it, 
minimizing system power consumption. Vpp genera- 
tion and switching methods are discussed in Section 
Ce 


Application code, assuming a ROM in the BIOS sock- 
et, is sometimes designed to write to BIOS locations to 
generate software timing delays (versus using NOPs). 
Gating WR# to the flash memory with a GPIO line 
disables writes until desired by BIOS update software. 


3.1 BIOS Boot Code Requirements 
and System Configurations 


The previous design assumed that shadow RAM was 
available in the system. Referencing Figure 8, we see 
that the BIOS is actually stored in the main block of the 
28FO01BX, from system address EOQOOOOH-FBFFFH. 
In this scenario, the processor jump vectors, BIOS 
checksum and recovery code are stored in the 8 Kbyte 
boot block. This is the area the processor will jump to 
on powerup or after reset. The boot block code will 
execute a checksum check of the main block for a valid 
BIOS. If successful, the processor will check system 
RAM, copy the main block code to high memory 
DRAM and jump to this area for the remainder of 


1 Mbyte DOS Map 
FFFFFH 


64K BIOS Location 


Additional BIOS Space 
MS-DOS ROM Ver. 3.22 


Adapter Space 


User Area 


Figure 8. 28F001BX-T in 1 Mbyte DOS Memory Map 
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Power On Self Test (POST), as well as further BIOS 
calls. Optionally, the 28FO01BX can then be disabled 
for power savings. 


If BIOS checksum determines an invalid BIOS, the sys- 
tem RAM and floppy drive (or possibly modem) are 
initialized using the boot block recovery code. The sys- 
tem requests (through screen display or speaker 
“beeps”’) that the user install the BIOS update floppy 
disk. A search of the floppy disk is made for a specific 
file name, and once found, update code is used to re-ini- 
tialize the main BIOS block. System reboot restores 
normal operation. Alternatively, the BIOS recovery 
code can contain specific, non-DOS sector/track infor- 
mation pertaining to the location of the new BIOS up- 
date file. Thus, the file is protected and not readable to 
basic DOS users. 


If ROM BIOS disable is overriden by system software 
or the user (through setup utility), the design must 
compensate for the altered BIOS location to prevent 
BIOS calls jumping to incorrect code locations. The 
following two methods provide alternative solutions for 
the system designer. 


Address Shift Configuration 


In this scenario, after BIOS initialization is complete, a 
write to a latch, register or flip-flop shifts addresses for 
future BIOS code fetches by 16 Kbytes. This allows the 
system to correctly access the main block and bypass 
parameter and boot blocks. A system reset or loss of 
power clears this latch, allowing booting from the boot 
block once again. Figure 9 shows the input and output 
signals required for a w»PLD address shifter. It shifts 
addresses in the range FFFFFH-E4000H (112 Kbytes) 
to FBFFFH-EOOO0H. 


28F001BX-T Memory Map 
Ps 16 Byte Jump Vector 
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Figure 9. Address Shift Circuitry 


Address Inversion Configuration 


Figure 10 presents an alternative approach to configur- 
ing the 28F001BX in the system memory map. Simple 
inversion of address line Aj¢ to the 28FO01BX moves 
the boot block to the lower half of flash memory as seen 
by the system. In normal operation, the processor boots 
and executes from the main array areas, which store the 
system BIOS, video BIOS and/or DOS in ROM. 


Recovery Code 


Parameter Block 
Parameter Block 


Figure 10. Inversion Configuration (Normal) 
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If power loss aborts a BIOS update, the main array 
block will be partially programmed/erased and the 
code in this block unusable. The system will “hang” or 
not boot at all. To boot from the boot recovery block, 
restore address Aj¢ polarity, producing the memory 
map shown in Figure 11. A keyboard sequence, switch 
on the back of the PC or jumper on the motherboard 
can toggle Aj¢ restore logic and “un-invert” it. After 
reconfiguration, the processor boots from the boot 
block and executes its recovery algorithm to restore 
main array block contents. Re-inverting A 16 reinstates 
normal system bootup and operation. 


Recovery Code 
Parameter Block 
Parameter Block | 


Figure 11. Inversion Configuration (Recovery) 


Since standard BIOS code does not support boot block 
recovery, your BIOS software engineers must design 
the recovery code for the 8 Kbyte block. See Section 4.6 
for a flowchart of an example recovery algorithm. 
Third-party BIOS vendors, working with Intel, have 
also developed recovery code for the 28FOOIBX (see 
Appendix C). With the exception of this recovery sec- 
tion, the rest of the BIOS remains the same. 
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3.2 Vpp Generation 


For flash BIOS designs, the 12V Vpp can be provided 
by: 


1. Using the existing 12V supply from PC Power Sup- . 


ply, or 
2. Generating 12V using a charge pump or DC-—DC 
converter from the 5V supply. 


Flash typically requires only 10 mA for program or 
erase (30 mA max); otherwise only 10 pA is drawn in 
standby mode, and 0.8 1A in deep powerdown mode. 


Using System 12V Directly 


As stated earlier, the IBM PC technical reference man- 
ual specifies the 12V supply as + 5% and —4%, which 
meets the Intel Flash Memory Vpp requirement. If 
your power supply meets this condition and has CMOS 
logic, 12V from the PC power supply can be tied direct- 
ly to flash memory, eliminating the need to add extra 
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circuitry for Vpp generation. This is possible due to the 
RP#, Vcc and Vpp write lockout protection offered in 
the 28FOOIBX. 


Pumping 5V to 12V 


If your system does not provide 12V or does not meet 
flash memory specifications, several 5-to-12V convert- 
ers are available, including surface-mount versions. Ap- 
plication Note AP-316, available from your local Intel 
Sales Office, lists several Vpp solutions which offer 
on/off control of Vpp and provide a steady Vpp rise 
and little overshoot. Figure 12 shows one example. On 
power-up, system reset or when Vcc is below 4.5V, 
Vpp is forced off. It is enabled (or disabled) by writing 
to the VppEN# I/O port address. On/off capability is 
essential for battery-operated equipment and eliminates 
the need for WE# filtering. The VppEN# signal 
“OR’ed” with the system memory write (MEMWR #) 
functions as the clock signal for the 74FC74 D-flip- 
flop. The D-input is latched when MEMWR# goes 
high. Writing a one or a zero turns Vpp on or off, 
respectively. 
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Figure 12. Vpp Generation with Write Protection 
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Linear Technology’s LT1072, a switching regulator, is 
used as a 5V to 12V charge pump. The 10.7K and 
1.24K resistors are used to establish the correct refer- 
ence voltage to obtain 12V. The 100 uF capacitor at the 
output can handle up to 200 mA. For a single- or dou- 
ble-chip BIOS design, this capacitor value can be 
halved or even quartered to allow selection of a SMT 
capacitor value, since the maximum Ipp current per 
device is only 30 mA (10 mA typical). Allow sufficient 
time when switching Vpp on, letting the charge pump 
level out and enabling the Command Register to re- 
ceive program or erase commands. The diode, 
MUR120, keeps the inductor from absorbing current 
from the charged output capacitor. 


Security 


Controlling Vpp provides the benefit of system hard- 
' ware security. Beyond this, you can design for even 
higher security levels. The first level could be the design 
of a simple software password routine that would only 
turn on Vpp when a correct password is given. Alterna- 
tively, you can provide a jumper to allow 12V to the 
part for a BIOS update and then return it when repro- 
gramming is finished. The system should check this pin 
to see if the jumper was left in the programming posi- 
tion and remind the user to move it. Unless Vpp is at 
12V, the flash memory contents cannot be changed and 
acts just like ROM. Disabling Vpp until voltages have 
stabilized provides additional power-up protection. 


The Motorola component, MC34064, is an under-volt- 
age sensing circuit that begins functioning when Vcc is 
above 1V. Between 1V and 4.6V, the RESET # output 
is active. This (or a system RESET#) clears the 
74FC74, keeping Vpp off. Alternatively, if you use 
CMOS logic, you could make use of Intel’s flash memo- 
ry Vcc and Vpp lockout functions. While Vcc is below 
2.5V, the Command Register is locked out. Since 
CMOS control logic is active at 2.0V, a 0.5V safety 
margin exists for control logic to settle down before the 
part becomes active. Program and erase attempts are 
inhibited with Vpp below 6.5V. For both CMOS and 
non-CMOS designs (i.e., control logic active at 2.0V), 
gate RP# with the power supply’s “Power Good” sig- 
nal or the MC34064’s RESET# output (Figure 13). 
Until RP # transitions to Vy, the part ignores all write 
attempts, regardless of power supply voltages and bus 
activity. 
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Figure 13. Vpp Switch Using MTD4P05 


Using a MOSFET Switch 


For laptops or palmtops, an always-active 12V may not 
provide acceptable power management. For these sys- 
tems, a MOSFET switch will toggle 12V to the flash 
memory, minimizing current draw when not needed. 
Several DC switches exist, but there are a few issues to 
consider in your selection. Choose a switch with low 
“ON” resistance to keep the Vpp voltage within flash 
memory tolerances. The system 12V power supply 
must be specified to a tighter range to allow for any 
voltage drop through the switch. Allocate an I/O line 
(Vpp enable) to turn the switch on and off. To handle 
“warm RESETS”, the Vpp enable must be gated with 
the system RESET # line. The Motorola MTD4P05 is 
one example of a surface-mount switch with low drain- 
source resistance. Assuming a 12V + 5% and —4% 


supply: 
Rps = 0.62 
Ipp = 30 mA (Worst Case) 


AVswitcH Drop = (30 mA x 0.62) = 0.02V, 
< (4% of Vpp =) 0.48V. 


Figure 13 shows a schematic of a Vpp switch design. 


3.3 Modifying an Existing 
Motherboard 


EPROM/ROM Designs 


If you are modifying an existing motherboard design 
for a flash memory BIOS, there are a few things you 
should consider. First, check the logic design to deter- 
mine if WR# is decoded and connected to the BIOS 
EPROM location. Typical motherboard logic designs 
do not allow writes to the EPROM locations and treat 
EPROM writes as invalid (e.g., ROMCS# not generat- 
ed with MEMWR#). This is overcome by generating 
the BIOS location’s WR# externally by either adding 
the necessary discrete logic or adding a 3-to-8 decoder 
(see Figure 14 for an example). In either case, tap into 
the M/IO# and WR# control lines and configure the 
decoder to provide a logic low for the M “AND” 
WR# “AND” BIOS address condition. 
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Discrete Flash WE # Solution 


FLASHWR# 
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Secondly, check to see if the BIOS code transceiver or 
buffer for the EPROM location works in both direc- 
tions. The transceiver may need a special BIOS call to 
unlock it in the “write” direction, or you may have to 
reprogram the logic for that portion of your board. If 
your chip set data buffer works only in one direction, a 
transceiver and direction logic must be added to the 
CPU bus to pass data to and from flash memory. 


Your system must also be capable of routing 12V to the 
BIOS socket for program and erase. Control RP # with 
system RESET # and POWERGOOD (see Section 3.0) 
and optionally provide capability for deep powerdown 
mode via an I/O line. Finally, address inversion or shift 
mechanisms outline in Section 3.1 can optionally be 
added for recovery capability with the 28FO01BX. 


28F010 Flash Memory Designs 


If your design currently incorporates Intel’s 28F010 
flash memory, hardware upgrade to the 28F001BX is 
simple. Transceiver, BIOS write and Vpp requirements 
will have already been considered in the original design. 
Control RP# as described in Section 3.0. Finally, in- 
vert or shift the system addresses as in Section 3.1 if 
BIOS “ROM” access after shadowing to DRAM is an- 
ticipated. 
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Figure 14. Discrete and Single-Chip Decoder WE # Solutions 
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3.4 In-System Write vs On-Board 
Programming 


When devices are soldered directly to a printed circuit 
board, one of two sources control flash memory repro- 
gramming: 


1. the system’s own processor, or 
2. a PROM programmer connected to the board. 


These options are called In-System Write (ISW) and 
On-Board Programming (OBP), respectively. Their re- 
spective benefits are discussed in detail in AP-316. 


With ISW, the system drives the reprogramming pro- 
cess and generates Vpp locally. Under this scenario, the 
board manufacturer will initially program at least the 
boot block in a PROM programmer. This removes the 
need for circuitry on-board to unlock the boot block, 
guaranteeing boot code integrity throughout system 
life. A good design practice for ISW-type designs is to 
socket the first few flash BIOS prototypes. SMT-only 
designs can also socket using PLCC SMT sockets. 
Socketing enables the system designer to easily work 
out any bugs with in-system flash reprogramming by 
allowing the removal of a flash part for external repro- 
gramming in a PROM programmer. Once ISW repro- 
gramming is fully debugged, pre-programmed flash 
parts can be soldered directly to the circuit board with- 
out a socket. All flash memory components are exposed 
to a data-retention bake testing and checked for any 
data loss before shipping. It is extremely unlikely that 
data in a production flash device can be corrupted from 
heat by a production-run soldering application. 


a 
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OBP uses an external board programmer to supply Vpp 
and Vyy and control the programming process. Cer- 
tain design considerations must be evaluated prior to 
laying out the design. Some manufacturers using TSOP 
may also want to remove a handling step from the man- 
ufacturing process by providing the capability to pro- 
gram flash for the first time after being soldered direct- 
ly onto the circuit board. OBP can accomplish this if 
the design is first laid out correctly to support OBP. 
External circuitry generates voltages needed to unlock 
and program/erase the boot block. 


3.5 Ideas for Using Extra Adaptor 
Space 


Laptop and palmtop systems may have adaptor space 
available in the system memory map since there typi- 
cally isn’t much room for add-in boards. Additionally, 
they may not use up the entire 128K of BIOS space due 
to their fixed feature set and limited upgrade capability. 
This extra memory space can hold ROM executable 
programs like Lotus 123, WordPerfect, Microsoft 
Works, etc. Using Intel’s flash TSOPs, a small applica- 
tion cache can reduce a laptop’s disk access and in- 
crease battery life. 


Additionally, ROM-Executable DOS can be placed 
anywhere in adapter space. For example, MS-DOS 
ROM Version 3.22 requires 62 KB of adaptor space 
today (this may change on subsequent revisions). One 
location for MS-DOS ROM Version 3.22 is directly un- 
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der the BIOS (again see Figure 8). Today’s typical 
BIOS consumes 64 KB or less; consequently, both the 
BIOS and MS-DOS ROM Version 3.22 could reside in 
a single 28FOO1IBX (128 Kbytes), yielding reduced 
chipcount. However, if power management code is add- 
ed to the BIOS, system BIOS code could grow to 
80 KB or more. Therefore, designs that include both 
power management and MS-DOS ROM Version 3.22 
should consider using both a 28FOO1BX and 28F010 
flash device (or two 28FO01BX’s). This leaves extra 
space for BIOS and MS-DOS ROM to grow in the de- 
sign, while providing additional storage for the video 
BIOS. 


4.0 SOFTWARE DESIGN 
CONSIDERATIONS 


Intel’s Flash Memory provides a cost-effective, updata- 
ble, nonvolatile code storage medium. The 28FO01BX 
integrates the Quick-Pulse Programming and Quick- 
Erase algorithms of prior Intel Flash Memories on- 
chip, using the Command Register, Status Register and 
Write State Machine (WSM). On-chip integration dra- 
matically reduces system overhead, simplifies system 
software creation and debug and provides SRAM-like 
timings to the Command and Status Registers. WSM 
operation, internal program/erase verify and Vpp high 
voltage presence are monitored and reported via appro- 
priate Status Register bits. Table 1 lists the 28FO01BX 
command set, while Table 2 details the Status Register 
bits and their meanings. 


Table 1. 28F001BX Command Definitions 


First Bus Cycle 


Second Bus Cycle 


Operation | Address | Data | Operation 


Read Array/Reset 


NOTES: 


Write 


70H 


| 
» | D 
a.) & 


BOH Write 


Write 


1. IA = Identifier Address; OOH for manufacturer code, 01H for device code. 


BA = Address within the block being erased. 
PA = Address of memory location to be programmed. 


2. SRD = Data read from Status Register. See Table 2 for a description of Status Register bits. 
PD = Data to be programmed at location PA. Data is latched on the rising edge of WE#. 


IID = Data read from intelligent identifier. 


3. Following the intelligent identifier command, two read operations access the manufacturer and device codes. 
4. Commands other than shown above are reserved by Intel for future device implementations and should not be used. 
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Table 2. 28F001BX Status Register Definitions 


jwsws| ess | es [| ps | vers | oR | oR | OR 
f 6 5 4 3 2 1 0 


WRITE STATE MACHINE STATUS 
1 = Ready 
0 = Busy 
ERASE SUSPEND STATUS 
1 = Erase Suspended 
0 = Erase In Progress/Completed 
ERASE STATUS 
1 = Error In Block Erase 
0 = Successful Block Erase 
PROGRAM STATUS 
1 = Error In Byte Program 
= Successful Byte Program 
Vpp STATUS 
1 = Vpp Low Detect; Operation Abort 
0 = Vpp OK 


SR.7 = 


SR.6 = 


SR.5 = 


SR.4 = 


SR.3 = 


SR.2-SR.0 = RESERVED FOR FUTURE ENHANCEMENTS 
These bits are reserved for future use and should be masked out when polling the Status Register. 


The WSM on-chip oscillator internally times the pro- 
gram/erase algorithms, making software timers unnec- 
essary. Block precondition is also controlled by the 
WSM as part of the erase algorithm. Block data pro- 
gramming to “0’s” before erasing is no longer needed. 


Intel’s high quality design, manufacturing and testing 
result in outstanding reliability and performance 
throughout device life. Although Program Status and 
Erase Status bits are provided for Status Register com- 
pleteness, errors will probably not be encountered, if 
proper Vpp levels and software sequences are imple- 
mented. | 


Intel offers standard software drivers, written in “C’, 
to assist software engineers implementing 28FO01BX 
reprogramming for update utilities. These high-level 
routines, found in Appendix A, are adaptable to a wide 
range of uP and pC platforms and system architec- 
tures. 


Covered in this section are the major software steps for 
a flash BIOS update utility: 


¢@ Update software for a modified system 
© Pseudo-Code overview 
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NOTES: 

The Write State Machines Status Bit must first be 
checked to determine program or erase completion, be- 
fore the Program or Erase Status bits are checked for 
SUCCESS. 

If the Program AND Erase Status bits are set to 1’s dur- 
ing an erase attempt, an improper command sequence 
was entered. Attempt the operation again. 

If Vpp low status is detected, the Status Register must be 
cleared before another program or erase operation is at- 
tempted. 

The Vpp Status bit, unlike an A/D converter, does not 
provide continuous indication of Vpp level. The WSM in- 
terrogates the Vpp level only after the program or erase 
command sequences have been entered and informs the 
system if Vpp has not been switched on. The Vpp Status 
bit is not guaranteed to report accurate feedback be- 
tween Vpp, and Vppy. 


¢ Initializing the system 
© Code loader routine 

e Flash re-programming 
e Recovery routines 

© Power management 


4.1 Update Software for a Modified 
System 


The design example of Section 3.0 assumes BIOS shad- 
owing for BIOS code execution while allowing BIOS 
writes to the flash socket. Many systems provide a reg- 
ister which enables BIOS writes and reads. Some sys- 
tems may not allow BIOS reads from RAM while per- 
forming BIOS writes to the flash socket, or vice versa. 
The reasons may be simple; no shadow RAM exists in 
the system (8088 or 8086 systems), or system logic 
treats “ROM writes” as an invalid operation. In these 
cases, perform all your required BIOS calls before you 
erase and program the flash memory. But keep in mind, 
to update the user on the progress of flash program- 
ming and indicate when programming is finished, you 
should add some basic screen or speaker “‘beep”’ rou- 
tines to your update utility. 
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4.2 Pseudo-Code Overview 


The following pseudo-code for an update utility pro- 
vides a brief description of the process of updating a 
BIOS in-situ. It is based on software developed by a 
customer for a PC platform with BIOS update capabili- 
ty. This Intel386-33 MHz system uses the 28FOOIBX 
for BIOS storage. Modify the flowchart below, if need- 
ed, for your particular chipset and hardware environ- 
ment. 


Pseudo-Code for Flash Update Routine 


Initialize system (set up user screen, check battery pow- 
er, check device ID) 


Get BIOS file options (from floppy or modem) 
If no file present 


Send error message to insert BIOS update flop- 
py, or press ESC to exit 


Display BIOS update files, prompt user for choice and 
load to memory 


If file invalid, 
Prompt for file or exit 


Inform user what is about to happen, with option to 
continue or exit 


If user continues, inform them to not turn off the 
power or soft-reboot (CNTL-ALT-DEL) 


Erase 28F001BX main/parameter blocks 
If system interrupt occurs | 
Suspend erase if flash memory access is required 
Resume Erase 


Write file[s] into flash memory 
Indicate to user that flash reprogramming is over 
Reboot the system 


4.3 Initializing the System 


Checking Power 


If your application is a laptop or palmtop computer, 
first check the battery to make sure there is enough 
power to do the update. If not, inform the user to re- 
charge the system before continuing the update and exit 
the update program. This ensures that the system won’t 
stop in the middle of an update. Next, initialize access 
to flash for reads and writes, then try reading the device 
ID through the Command Register. Checking the de- 
vice ID before programming or erasing helps determine 
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if reads and writes work correctly and that the flash 
memory in the system matches your code before start- 
ing to reprogram the part. The manufacturer ID for 
Intel flash memories is 89H (10001001), located at de- 
vice address OOOO0H. Device IDs are located at address 
00001H; the ID for the 28FOOIBX-T is 94H 
(10010100), and the 28FO01BX-B device ID is 95H 
(10010101). These device addresses, in the DOS memo- 
ry map, correspond to system addresses EOOOOH (mfgr. 
ID) and E0001H (device ID). If A'j¢ inversion is used 
as described in Section 3.1, system addresses for mfgr. 
ID and device ID under normal operation are FOOOOH 
and FO001H. 


NOTE: 
During the initialization, you can also perform a scan 
of the adaptor space to ascertain if there is more flash 
in the system. Other Intel Flash Memories share com- 
mon manufacturer IDs but have unique device IDs, 
listed below: 


Device Device ID 
ID (Hex) (Binary) 


28F 256A 10111001 — 
28F512 10111000 
28F010 10110100 | 
28F020 10111101 
28F001BX-T 10010100 


28F001BX-B 10010101 


4.4 Code Loader Routine 


The update utility described in the previous section 
provides an optional mouse-driven color graphical user 
interface (GUI) and allows not only BIOS update to 
the main block but also update of the parameter blocks, 
and copy/compare of block data to a DOS file. These 
types of features convey to the end user the ease and 
simplicity of performing a BIOS update. For example, 
the main block update utility lists all possible BIOS 
files in the selected drive and directory, and prompts 
the user for the desired file. System OEMs may want to 
encode a specific BIOS file name into the generic loader 
utility “COM” or “.EXE” file. This allows automatic 
reading of the new BIOS file into a program buffer, 
bypassing the user prompt. 


Once the file is loaded into RAM, the routine informs 
the user of the impending BIOS update and provides 
the option to exit if desired. If continued, it warns the 
user to not turn off power or reboot during the BIOS 
update procedure. It then erases and reprograms the 
main block with new BIOS data, notifies the user of 
successful update and reboots. 
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4.5 Flash Reprogramming Routines 


On-Chip Erase Algorithm 


The 28F001BX system erase algorithm is shown in Fig- 
ure 15. Note that the actual device erase algorithm 
(Quick-Erase) is controlled internally, including all tim- 
ing and block preconditioning. This provides the same 
high level of reliability proven on Intel’s ETOX II tech- 
nology, while reducing system debug efforts. Erase 
progress is reported to system software thru specific 
Status Register bits. The 28FO01BX erases all bits of a 
block in parallel. Minimum and typical erase times for 
each block are listed below: 
Minimum Typical 


| Block Time (Sec) Time (Sec) 


Parameter (ea.) 1.3 2.1 
Main 3.0 3.8 
Boot 1.3 2.1 
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The actual erase time depends on the Vpp voltage level 
(11.4V-12.6V), temperature and the number of erase 
cycles already completed on the part. System software 
must comprehend adequate time for Vpp, after enabled, 
to ramp to 12V before erase is attempted. Capacitors on 
the Vpp bus, in addition to the intrinsic pump nature of 
many 12V solutions, cause an RC ramp. Systems that 
direct-wire 12V need not worry about this delay. 


Erase Suspend/Resume 


Erase suspend gives the user the ability, while erasing a 
block of the 28FO01BX, to read data or execute code 
from another block. This capability, in conjunction 
with the minimal system overhead provided by the 
WSM, makes disabling of interrupts during block erase 
unnecessary. Once given the erase suspend command, 
the WSM halts, reports suspend status to the Status 
Register and allows array reads. When issued erase re- 
sume, it proceeds at the point where it was suspended. 
Figure 16 details the system code flowchart that sus- 
pends and resumes erase. 


7 | ’ 
intel ite 
® ‘ 
Bus 
option | Command | Comments 


Write 20H, “= 
Block Address Data = 20H 7 
Address = Within Block 


to be erased 
Data = DOH 


Address = Within Block 
to be erased 


Status Register Data. 
Erase Suspend Toggle OE # or CE# to 
Loop update Status Register 


Standby Check SR.7 
1 = Ready, 0 = Busy 


Repeat for subsequent blocks. 


Full status check can be done after each block or after 
a sequence of blocks. 


Write FFH after the last block erase operation to reset 
the device to Read Array Mode. 


Block Erase 
Completed 
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FULL STATUS CHECK PROCEDURE 


sae Comments 
Operation 


Standby Check SR.3 
1 = Vpp Low Detect 


Standby Check SR.4, 5 
Both 1 = Command 
Sequence Error 


Standby Check SR.5 
1 = Block Erase Error 


SR.3 MUST be cleared, if set during an erase attempt, 
before further attempts are allowed by the Write State 
Machine. 


YES 
Block Erase 
SR.5 is only cleared by the Clear Status Register 
Command, in cases where multiple blocks are erased 
292077-15 before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 15. 28F001BX Block Erase Algorithm 
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Bus 
mment 
Operation | Command Comments 
Write BOH Erase Data = BOH 


Suspend 


Read Data = 70H 
Status Register 


Standby/ Read Status Register 
Read Check SR.7 
1 = Ready, 0 = Busy 
Toggle OE # or CE# 


S to update Status 


Register 
YES 


Standby Check SR.6 
1 = Suspended 


Erase Has 
ides Completed 


Read Array | Data = FFH 


Read array data from 
block other than that 
being erased. 


Write DOH Erase Resume | Data = DOH 


Continue Erase 
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Figure 16. 28F001BX Erase Suspend/Resume Algorithm 
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Operation 


Program Data = 40H 
Setup Address = Byte to 
be programmed 
Write Byte Program Data to be Programmed 
Address/Data Address = Byte to 
be programmed 


Status Register Data. 
Toggle OE # or CE# to 
update Status Register 


Standby Check SR.7 
1 = Ready, 0 = Busy 
Repeat for subsequent bytes. 


Full status check can be done after each byte or after 
Full Status a sequence of bytes. 


Check if Desired 
em st Sven Write FFH after the last byte programming operation to 


reset the device to Read Array Mode. 
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FULL STATUS CHECK PROCEDURE 


Sus Command Comments 
Operation 


Standby Check SR.3 
1 = Vpp Low Detect 


Standby Check SR.4 
1 = Byte Program Error 
SR.3 MUST be cleared, if set during a program 


attempt, before further attempts are allowed by the 
Write State Machine. 


YES 
SR.4 is only cleared by the Clear Status Register 
inna Command, in cases where multiple bytes are 
292077-18 programmed before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Figure 17. 28F001BX Byte Programming Algorithm 
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On-Chip Programming Algorithm 


As with 28F001BX erase, the Intel flash Quick-Pulse 
algorithm is internally controlled by the WSM. Figure 
17 shows a system software flowchart for the Com- 
mand Register/Status Register interface. Minimum 
and typical programming times (per byte) are 15 ps 
and 18 ps, respectively. Actual time varies with Vpp, 
temperature and cumulative programming cycles on 
the device. Ensure that stable 12V is applied to the 
device before attempting byte programming. 


Full Status Checks 


After polling the Status Register and determining that 
the WSM is again READY, system software should 
further analyze the Status Register to ensure that pro- 
gram or erase has successfully completed. The WSM 
will return to READY status after program or erase 
command sequences under any of the following condi- 
tions: 


¢ Program/erase completed successfully, 


© Vpp transition below specification during the pro- 
gram/erase attempt, 


e Improper sequence of erase setup/confirm com- 
mands to the WSM, or 


e Inability to erase the specified block, or program the 
desired byte. 


Figures 15 and 17 detail the additional Status Register 
data analysis to ensure that program or erase have suc- 
cessfully occurred. 


4.6 Recovery Routine Overview 


Unsuccessful BIOS update can occur for any of the 
reasons listed below: 


1. Vpp transitions out of specified tolerance during 
program or erase. 


2. Incorrect code in the update BIOS disk file, or dam- 
aged BIOS disk. 


3. Loss of system power during program or erase. 


4. System reset (such as reboot) during program or 
erase. 


The Status Register, through bit 3, reports Vppy loss to 
system software. The BIOS update utility can detect 
scenario | and recover by simply re-attempting block 
update. 


A checksum of update BIOS code after copy from disk 


to RAM, before flash erase and reprogram, will elimi- 
nate error caused by scenario 2. 
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PC motherboard logic should gate the 283FO001BX RP # 
pin with both POWER GOOD and RESET # signals, 
to abort program or erase attempts if either scenario 3 
or 4 were to occur. This allows the processor to execute 
code out of the 8 Kbyte boot block upon system recov- 
ery. System reset or loss of system power will clear the 
Status Register to value 80H, leave the block being up- 
dated partially programmed or erased and reset the 
28F001BX to Read Array mode. As detailed previously 
in Section 3.1, a checksum of the main block will alert 
the system to an incomplete BIOS. Recovery is 
achieved by the following or similar steps: 


@ Initialize CPU and system logic. 
e Initialize the system floppy disk. 


e Prompt the user to insert a BIOS diskette, through 
speaker “‘beep”’. 


e Erase and reprogram the main and/or parameter 
blocks with file data. 


® Reboot 


4.7 Power Management 


Battery-powered PCs incorporate a variety of tech- 
niques to prolong system life between recharges. Typi- 
cally, power management software senses user inactivi- 
ty and shuts off power-intensive sections of the system. 
Options include: 


e Display powerdown 

e Disk/hard drive powerdown 

e@ System clock slowdown or suspend, and 

© Powerdown of non-volatile circuitry in the system. 


The 28FO01BX fits the latter description. When the 
RP# pin transitions to GND, the device enters an ul- 
tra-low power mode, typically consuming 0.25 wW 
thru Voc. This technique can also be used to power 
down the BIOS memory after BIOS code has been 
shadowed to DRAM, if available in the system. When 
not programming or erasing the 28FOO1BX, the system 
should shut off 12V Vpp to the part to minimize cur- 
rent draw through this supply. 


User inactivity is typically detected if the keyboard has 
not been used, or the disk drive has not been accessed, 
for a predetermined interval (this is often user-pro- 
grammable). Power management software must ensure 
that a BIOS update is not occurring, before powering 
down the 28F001BX, to prevent incomplete update. 


For more information on power management tech- 
niques, consult datasheets and application notes on the 
Intel386SL microprocessor superset. 


intel. 
5.0 SUMMARY 


5.1 Traditional BIOS Storage and 
Disadvantages 


Traditional BIOS storage has been in EPROM, which 
offers nonvolatility and factory programming capabili- 
ty. In earlier PCs, the BIOS code was fairly simple (rel- 
ative to today’s software) and updates were infrequent, 
so EPROMs or ROMs were an acceptable BIOS stor- 
age medium. Today’s systems are much more sophisti- 
cated, with many designs supporting the Intel 
1386/i486™M microprocessors and new bus architec- 
tures like MCA and EISA for the first time. These new 
buses allow peripherals to take control of the system 
bus . . . it is difficult to guess what new system configu- 
rations might emerge. Therefore, the potential for a 
change in the BIOS code is much greater and the fre- 
quency of change is likely to increase. 


A system designer may use EPROMs for BIOS storage 
to reduce initial system (component) costs, but the 
long-term update cost is much more than the difference 
between EPROM and flash memory components. A 
major manufacturer of PCs has estimated that a service 
call for a BIOS update with EPROMs can cost up- 
wards of $300.00 for ONE update at ONE site. 
EPROMs are also susceptible to bent leads during in- 
sertion by the technician, or more likely, the end user. 
Service is becoming a key differentiator between the 
multitudes of PC makers. Reducing the number of 
times a PC has to be opened for any reason and provid- 
ing improved service increases customer confidence and 
promotes a reliable image. 


5.2 Advantages of an Updatable BIOS 


Using flash memory for BIOS storage provides a flex- 
ible code medium that allows the BIOS code to adapt to 
changing hardware and software conditions. BIOS up- 
dates in flash are inexpensive, via a floppy disk or mo- 
dem. They remove EPROM inventories, reduce pack- 
aging requirements, reduce total postage costs and 
eliminate service cost for BIOS code updates by remov- 
ing the need for a technician to do the update. A com- 
pany that supports mutiple OEMs can improve version 
management control by using a flash BIOS and floppies 
or a BBS for updates. An additional benefit is that not 
only the BIOS, but DOS itself can be stored in the same 
flash memory device. 


5.3 Advantages of Adding DOS in 
FLASH 


Once the requirements for flash memory BIOS are met, 
the capability is also in place for adding DOS in 
FLASH. Why put DOS in FLASH? For laptop and 
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palmtop PCs, battery longevity is of paramount con- 
cern, followed closely by weight and increasing user 
RAM (640 KB) space. Extra user RAM is needed for 
applications that require more than the typical 
' 570 Kbytes (640 KB-—70 KB) available with disk-based 
DOS. Digital Research Incorporated and Microsoft 
both make “DOS-in-ROM” products that address 
these needs. MS-DOS ROM version 3.22 is an example. 


Microsoft’s MS-DOS ROM Version 3.22 is a full-func- 
tion version of MS-DOS 3.2. It features instant-on and 
employs only 15 KB of the 640 KB DOS RAM user 
space, leaving the rest for applications. Since MS-DOS 
ROM Version 3.22 loads from adaptor space, both disk 
access and DOS loadtime are reduced. For laptops, 
anything that can reduce disk access equates to battery 
longevity. Laptops can reduce weight by using MS- 
DOS ROM Version 3.22 and replacing the floppy drive 
with an IC card. Adding MS-DOS ROM Version to 
desktops also liberates additional user RAM for the 
same above reasons, but may not be optimal for high 
, speed 32-bit systems. 


All future versions of MS-DOS will be supported with 
equivalent versions of MS-DOS ROM. See Appendix B 
for more information. 


5.4 Advantages of Adding 
1 MB-4 MB of Resident Code 
Storage 


There is a growing need for systems to be able to pro- 
vide a small suite of bundled applications. Benefits to 
the user are faster application execution thru reduced 
hard or floppy disk access, no power used to store the 
resident code, and instant-on. No time is wasted trans- 
ferring data over a disk I/O interface. The code is 
instead loaded to RAM with a simple memory copy 
function or procedure. In some cases, code is directly 
executed by the processor. Tandy’s Deskmate is an ex- 
ample of such a system. Future versions of Deskmate- 
like user interfaces could easily be made flash-updata- 
ble. SRAM is too expensive and requires power to just 
store files. Furthermore, battery backup is not a reliable 
means of achieving nonvolatility. Intel’s Flash Memory 
can provide user configurability for 1 MB—4 MB of 
code storage for just 2x—3x the cost of EPROMs and 
less than half the cost of SRAM. Applications such as 
Lotus 123, WordPerfect and Microsoft Works also 
come in either a direct-execute ‘““ROM” version or a 
load-from-ROM format. Many other ROM application 
software packages are in development, servicing the 
successful and growing needs of the laptop/palmtop 
computers. Therefore, if an application can be stored or 
runs from ROM, it can be stored and run from flash. 
As software packages are periodically updated, flash 
memory provides the capability of updating these 
“ROM” applications at little cost to the software ven- 
dor and with no system disassembly required. 
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APPENDIX A 
SOFTWARE ROUTINES 


JESHHEELAELERESEERERSERE SER EERE REELS EEEAARELE EAE EES ELESERLELE LESS LEA REE HARELE REL HESS & / 
Copyright Intel Corporation, 1991 

Brian Dipert, Intel Corporation, July 14, 1991, Revision 1.4 

The following drivers control the Command and Status Registers of 


/* 
/* 
/* 
/* 


/* 


the 28FO01BX Flash Memory to drive byte program, block erase, Status 
Register read and clear and array read algorithms. 
Sample Vpp and RP# control blocks are also included. 


The functions listed below are included: 


erasbgen(): Begins block erasure 

erassusp(): Suspends erase to allow reading data from a block of the 
28FO01BX other than that being erased 

erasres(): Resumes erase if suspended 

end(): Polls the Write State Machine to determine if block erase or 
byte program have completed 

eraschk(): Executes full status check after erase completion 

progbgn(): Begins byte programming 

progehk(): Executes full status check after byte program completion 

idread(): Reads and returns the manufacturer and device IDs of the 
target 28FOO1LBX 

Statrd(): Reads and returns the contents of the Status Register 

Statclr(): Clears the Status Register 

rdmode() : Puts the 28FOO1BX in Read Array mode 

rdbyte(): Reads and returns a specified byte from the target 28FO01BX 

vppup(): Enables high voltage Vpph 

vppdown(): Disables Vpph 

pwdon(): Ramps the RP# pin to high voltage Vhh, enabling boot block 
program/erase 

pwdoff(): Disables high voltage Vhh on RP#, disabling program 
and erase of boot block 


Addresses are transferred to functions as pointers to far bytes (ie long 


To 


integers). An alternate approach is to create a global array the size of the 
28FOO1LBX and locate "over" the 28FOO1BX in the system memory map. Accessing 
specific locations of the 28FO01BX is then accomplished by passing the chosen 
function an offset from the array base versus a specific address. Different 
microprocessor architectures will require different array definitions; ie for 
the Intel architecture, define it as "byte boot [2][10000]" and pass each 
function TWO offsets to access a Specific location. MCS=-51 architectures 

are limited to "byte boot[10000]"; alternate approaches such as writing to 
control bits will be required to access the full flash array 


create a far pointer, a function such as MK_FP() can be used, given 
a segment and offset in the Intel architecture. I use Turbo-C; see your 
compiler reference manual for additional information. 


vf 
*/ 


*/ 
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/* Revision History: Rev 1.4 */ 
7 */ 
/* Changes from 1.0 to 1.1: Added typedef for "byte" to accurately reflect a 
;* this x8 device. Altered variable definitions accordingly. Combined */ 
/* functions progend() and erasend() into function end(). */ 
* “j 
/* Changes from 1.1 to 1.2; Added this revision history block. Added above * / 
/* comments on alternate addressing methods. */ 
fs ri 
/* Changes from 1.2 to 1.3: Added pass/fail error return from idread(), + J 
/* idread() at beginning of progbgn() and erasbgn(), pass/fail error * 
j* return from progbgn() and erasbgn(). * 
;* . *y 
/* Changes from 1.3 to 1.4: Revised code to reflect simplified program and LF 
| i erase algorithms. 28FOO1BX automatically transitions to Read Status Register */ 
/* mode after program command sequence, erase command sequence and remains in ba 
j* Read Status Register mode after Erase Suspend is issued. Address O000H is no */ 
/* longer required to read or clear the Status Register. */ 


JSEFFSERETEEREKS SURKRESES LEE RSSE LE ELS ESCSS SEVERE KES EER ESSSEELAI SEL EH ERS PRESS ERSSE SAAB EG / 


typedef unsigned char byte; 


SEFPESESLES RECESS REL SS ELS ESR ESL ELE S ELSES LOK ASSESS CELE SSS SE LSE SCS SCALA HERES LSS RSE RS ELS SS J 


/* Function: Main */ 
/* Description: Included only to omit errors when attempting to compile code. * / 
/* The end customer would insert their main program here. */ 


fRTSRFSATELESER SE SEALS SSS ESTAS SEA SSS SSCRS COMTES FHS LES TLS FESS SIRS SHE SLES SALT ESO CES OS / 


main () 
{ 
} 


« FESSESES ESS SS ESE SES SSS ESSE SESS SST RS SES SESE SSE E PRG EST LETS ROSE SS PSS ECLA ESET SS SS SLES 


/* Function: Erasgbn *7 
f* Description: Begins erase of a block. * / 
/* Inputs: blckaddr: System address within the block to be erased * 
/* Outputs: None * / 
/* Returns: 0 = Erase successfully initiated ol 
/* l = Erase not initiated (ID check error) a 
/* Device Read Mode on Return: Status Register (ID if returns 1) | al | 


fPORSES CERISE THEE FOESSCES FDS PES FHA SOR ESSE ELSES RES CIF COE LEA ESL ORR RES SAPS ON VOR OS CRS 


#define ERASETUP 0X20 /* Erase Setup command * 
#define ERASCONF OXDO /* Erase Confirm command */ 


int erasbgn(blckaddr) 


byte far *blckaddr; /* blckaddr is an address within the block to be */ 
/* erased a 
{ 
if (idread()==1) /* ID read error; device not powered up? * 
return (1); ‘ 
*bleckaddr = ERASETUP ; /* Write Erase Setup command to block address *] 
*blckaddr = ERASCONF; /* Write Erase Confirm command to block address * 
return (0); 
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/* Function: Erassusp *f 
/* Description: Suspends block erase to read from another block */ 
/* Inputs: None */ 
/* Outputs: None “7 
/* Returns: 0 = Erase suspended */ 
/* 1 = Error; Write State Machine not busy (erase Suspend not possible) */ 
f* Device Read Mode on Return: Read Status Register */ 


Y Taclaclndadlaala dle dodladladlnedladiedediadladieledladiadindediadlodiedadiodlodediadiodiodadiadiodiiadiadotadladiodaddadiodiadadladlededadlededdadiodeediailedioiedudlededadladiadaiiadladtadaindadadiaileddailadaied | 


\ 


#Gefine RDYMASK 0X80 /* Mask to isolate the WSM Status bit of the * / 
f* Status Register */ 
#define WSMRDY 0X80 /* Status Register value after masking, signifying * / 
/* that the WSM is no longer busy */ 
#define SUSPMASK 0X40 /*Mask to isolate the Erase Suspend Status bit of the */ 
/* Status Register */ 
#define ESUSPYES 0X40 /* Status Register value after masking, signifying * / 
f* that erase has been suspended */ 
#define STATREAD 0X70 /* Read Status Register command */ 
#define SYSADDR 0 /* This constant can be initialized to any address * 
/* within the memory map of the target 28FO0O1BX * ] 
/* ‘and is alterable depending on the system wf 
/* architecture +f 
#define SUSPCMD OXBO /* Erase Suspend command */ 


int erassusp() 


byte far *stataddr; /* Pointer variable used to write commands to device */ 
Stataddr = (byte far *)SYSADDR; 
*stataddr = SUSPCMD; /* Write Erase Suspend command to the device * / 
*Stataddr = STATREAD; /* Write Read Status Register command to 28F001BX *] 
while ((*stataddr & RDYMASK) != WSMRDY) 
: /* Will remain in while loop until bit 7 of the */ 
/* Status Register goes to l, signifying that the */ 
/* WSM is no longer busy */ 
if ((*stataddr & SUSPMASK) == ESUSPYES) 
return(0) ; /* Erase is suspended ... return code "0" * 
return(1) ; /* Erase has already completed; suspend not possible. */ 
/* Error code "1" ae 
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/* Function: Erasres */ 
/* Description: Resumes block erase previously suspended */ 
/* Inputs: None * 
the Outputs: None */ 
/* Returns: 0 = Erase resumed is */ 
j* 1 = Error; Erase not suspended when function called */ 
/* Device Read Mode on Return: Status Register */ 


[HH HE AH HH HA HH AA A A RH RE EE EE REE ER EER 


#define RDYMASK OX80 /* Mask to isolate the WSM Status bit of the “7 
/* Status Register aa 
#define WSMRDY 0X80 /* Status Register value after masking, signifying */ 
/* that the WSM is no longer busy * / 
#define SUSPMASK 0X40 /* Mask to isolate the Erase Suspend Status bit od 
/* of the Status Register * 
#define ESUSPYES 0X40 /* Status Register value after masking, signifying al 
/* that erase has been suspended * / 
#define STATREAD 0X70 /* Read Status Register Command * 
#define SYSADDR 0 /* This constant can be initialized to any 7 F 
/* address within the memory map of the target */ 
/* 28FO01BX and is alterable depending on the */ 
/* System architecture */ 
#define RESUMCMD OXDO /* Erase Resume Command ad J 


int erasres() 


{ 


byte far *stataddr; /* Pointer variable used to write commands to device */ 


Stataddr = (byte far *)SYSADDR, 


*stataddr = STATREAD; /* Write Read Status Register command to 28F001BX * / 
if ((*stataddr & SUSPMASK) != ESUSPYES) 
return (1); /* Erase not suSpended. Error code "1" * 
*stataddr = RESUMCMD; /* Write Erase Resume command to the device *7 
while ((*stataddr & SUSPMASK) == ESUSPYES) 
| : /* Will remain in while loop until bit 6 of the *] 
| /* Status Register goes to 0, signifying * 
/* erase resumption */ 
while ((*Stataddr & RDYMASK) == WSMRDY) 
. /* Will remain in while loop until bit 7 of the */ 
Fh Status Register goes to 0, signifying eal J 
/* that the WSM is once again busy aa | 


return (0);3 
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/* Function: End 


/* Description: Checks to see if the WSM is busy 


/* (is program/erase completed?) 

Fh Inputs: None 

jf Outputs: statdata: Status Register data read from device 
/* Returns: 0 = Program/Erase completed 

/* 1 = Program/Erase still in progress 

j* Device Read Mode on Return: Status Register 
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#define RDYMASK 0X80 
#define WSMRDY 0X80 


#daefine STATREAD 0X70 
#define SYSADDR a 


int end (statdata) 
byte *statdata; 


{ 
byte far *stataddr; 


Stataddr 
*stataddr = STATREAD; 


/* 
/* 
/* 


/* 
j* 


/* 


Mask to isolate the WSM Status bit of the 
Status Register 

Status Register value after masking, signifying 
that the WSM is no longer busy 

Read Status Register command 

This constant can be initialized to any 
address within the memory map of the target 
28FOO1BX and is alterable depending on the 
system architecture 


Allows Status Register data to be passed back 
to the main program for further analysis 


Pointer variable used to write commands to 
device 


(byte far*) SYSADDR ; 


Write Read Status Register command to 28FOO1BX 


if (((*statdata = *stataddr) & RDYMASK) != WSMRDY) 


return (1); 
return (0) 3 
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/* Function: Eraschk Ff 
/* Description: Completes full Status Register check for erase (proper ad A 
/* command sequence, Vpp low detect, erase success). This routine assumes 77 
/* that erase completion has already been checked in function end() and * 
/* therefore does not check the WSM Status bit of the Status Register * / 
/* Inputs: statdata: Status Register data read in function end * 
/* Outputs: None * / 
f* Returns: 0 = Erase completed successfully */ 
j* 1 = Error; Vpp low detect */ 
/* 2 = Error; Block erase error * 
y* 3 = Error; Improper command sequencing */ 
/* Device Read Mode on Return: Same as when entered oat J 


FEFSEESE EEE SS ERS PERLE VES DEFER GES SEO RE CSLS PE SEV TO SSE EEF BOS TEER CSAS SEP SORE OS OEY 


#define ESEQMASK 0X30 /* Mask to isolate the Erase and Program * 
/* Status bits of the Status Register * 
#define ESEQFAIL OX30 /* Status Register value after masking if erase * 
j* command sequence error has been detected */ 
#define ERRMSK 0X20 /* Mask to isolate the Erase Status bit of the af 
/* Status Register */ 
#define ERASERR OX20 /* Status Register value after masking if erase error */ 
y* has been detected */ 
#define VLOWMASK 0X08 /* Mask to isolate the Vpp Status bit of the Status * 
J? . Register ‘ * 
#define VPPLOW 0X08 /* Status Register value after masking if Vpp low */ 
/* has been detected */ 


int eraschk(statdata) 


byte statdata; /* Status Register data that has been already read 7 
/* from the 28F001BX in function end() */ 


if ((statdata & VLOWMASK) == VPPLOW) 


return (1); /* Vpp low detect error, return code "1" */ 
if ((Statdata & ERRMSK) == ERASERR) 

return (2) ; /* Block erase error detect, return code "2" */ 
if ((statdata & ESEQMASK) == ESEQFAIL) 

return (3) ; /* Erase command sequence error, return code "3" */ 
return (0) 3 /* Block erase success, return code "0" es 
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/* Function: Progbgn tj 
/* Description: Begins byte program sequence */ 
/* Inputs: pdata: Data to be programmed into the device */ 
/* paddr: Target address to be programmed “7 
/* Outputs: None */ 
/* Returns: 0 = Program successfully initiated */ 
/* 1 = Program not initiated (ID check error) al A 
/* Device Read Mode on Return: Status Register (ID if returns 1) *7 


sPSPSTESSSSSESESTRTSHSESELESLSSESSTSSSSSSSLLS TAA SSEVISSE SSS KEES SE LSS KLSERE SSS ERLESSESE / 


#define SETUPCMD 0X40 /*Program Setup command */ 


int progbgn (pdata,paddr) 


byte pdata; /* Data to be programmed into the 28F001BX a 
byte far *paddr; /* paddr is the destination address for the data */ 
/* ' to be programmed */ 

{ 
af. (idreadi) s= 1) /* Device ID read error...powered up? sal 

return (1); 

*paddr = SETUPCMD; /* Write Program Setup command and */ 
/* destination address */ 
*paddr = pdata; /* Write program data */ 
/* and destination address */ 


return (0); 
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/* Function: Progchk 
/* Description: Completes full Status Register check for byte program (Vpp low 


/* detect, programming success). This routine assumes that byte program 
/* completion has already been checked in function end() and 
/* therefore does not check the WSM Status bit of the Status Register 


f* Inputs: statdata: Status Register data read in function end 
y* Outputs: None 

Yi Returns: 0 = Byte programming completed successfully 

/* 1 = Error; Vpp low detect 

/* 2 = Error; Byte program error 

/* Device Read Mode on Return: Status Register 


SUP EFESELS FEN SSE SE SER ESS SSE SESS SE PRESS SSS SESS SS PS SSE SIRE SEES PEGE SERS PERS ES FES CSRS SF / 


#define PERRMSK OX10 /* Mask to isolate the Program Status bit of the 


/* Status Register 

#define PROGERR OX10 /* Status Register value after masking if program 
j* error has been detected 

#define VLOWMASK OX08 /* Mask to isolate the Vpp Status bit of the Status 
/* Register 

#define VPPLOW Ox08 /* Status Register value after masking if Vpp low 
/* has been detected 

int progechk (statdata) 

byte statdata; /* Status Register data that has been already read 
/*- from the 28FO001BX in function end() 


if ((statdata & VLOWMASK) == VPPLOW) 


return (1); /* Vpp low detect error, return code "1" 
if ((Sstatdata & PERRMSK) == PROGERR) 

return (2); /* Byte program error detect, return code "2" 
return (0); /* Byte/string program success, return code "0" 


*/ 
*/ 
a i 
bs 
*/ 
“yf 
*/ 
“/ 


“/ 
Bs 4 


*/ 


nt 
*/ 
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/* Function: Idread 


\ 


/* Description: Reads the manufacturer and device IDs from the target 28F001BX 
/* Inputs: None 

/* Outputs: mfgrid: Returned manufacturer ID 

/* deviceid: Returned device ID 

7* Returns: 0 = ID read correct 

/* lL = Wrong or no ID 


/* Device Read Mode on Return: Intelligent Identifier 
fPSFESESS EEK CLERERGES EES ETE ESTE SESS SERRE ESA ES SAHA ES EASES LER SEEPS ESAS ESS SECA SR! 


#define MFGRADDR 0 
#define DEVICADD “2 
#define IDRDCOMM 0X90 
#define INTELID 0X89 
#define DVCIDBT 0X94 


int idread(mfgrid,deviceid) 


byte *mfgrid; 


byte *deviceid; 


{ 
byte far 


tempaddr 
*tempaddr 


*nfgrid 
tempaddr 
*deviceid 


*tempaddr ; 


(byte far*)MFGRADDR ; 


IDRDCOMM ; 


*tempaddr ; 


/* 


/* 
/* 
/* 
/* 


(byte far*)DEVICADD ;/* 


*tempaddr; 


/* 


Address "0" for the target 28FO01BX... 
| alterable depending on the system 

architecture 

Address "1" for the target 28FOO1BX... 
alterable depending on the system 
architecture 

Intelligent Identifier command 

Manufacturer ID for Intel devices 

Device ID for 28FO01BX-T; change to 95H if 
using 28FOO1LBX-B!!! 


The manufacturer ID read by this function, to 
be transferred back to the calling 
program 

The device ID read by this function, to be 
transferred back to the calling function 


Pointer address variable used to read IDs 


Write intelligent identifier command to an 
address within the 28FO01BX memory map 
(in this case, OOH) 

Read mfgr ID, tempaddrstill points at address "0" 

Point to address "1" for the device specific ID 

Read device ID 


if ((*mfgrid != INTELID)||(*deviceid != DVCIDBT) ) 
return (1); 


return (0); 
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ID read error; device powered up? 
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/* Function: Statrd 

/* Description: Returns contents of the target 28FOO1BX Status Register 
I hs Inputs: None 

/* Outputs: statdata: Returned Status Register data 

/* Returns: Nothing 

/* Device Read Mode on Return: Status Register 


me, 
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#define STATREAD OX70 /* Read Status Register command 


#define SYSADDR 0 /* This constant can be initialized 
/* to any address within the 
/* memory map of the target 28F001BX 
/* and is alterable depending on 
/* the system architecture 


int statrd(statdata) 


byte *statdata; /* Allows Status Register data to 
/* be passed back to the calling program 
a for further analysis 


byte far *stataddr; 


stataddr 
*stataddr 


*Statdata 
return; 


/* Pointer variable used to write 


j* commands to device 
(byte far*) SYSADDR; 
STATREAD ; /* Write Read Status Register 
/* command to 28FOO1BX 


*stataddr; 
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/* Function: 


Statclr 


/* Description: Clears the 28FO0O1BX Status Register 
/* Inputs: None 
/* Outputs: None 


j* Returns: Nothing 


/* Device Read Mode on Return: Status Register 
fERAFECES EELS SECEE ESSE SELLERS ESSE SL ELES SE SEE EKA EES SELLERS LEPEELE LE ELOES TERED E SED SHY 


#define STATCLER 


#define SYSADDR 0 


int statelr() 


{ 


byte far *stataddr; 


stataddr 
*stataddr 


return; 


j 


OX50 


/* Clear Status Register command 

/* This constant can be initialized to any 

i address within the memory map of the targe 
/* 28FOO1BX and is alterable depending on 

/* the system architecture 


/* Pointer variable used to write commands to 
f device 


(byte far*) SYSADDR ; 


STATCLER ; 


/* Write Clear Status Register command to 
/* 28F001BX 


ad 
“Fy 
a 
*/ 
*/ 
ws 


“F 
“/ 
a | 


at 


*/ 


*/ 


i 
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/* Function: Rdmode 
/* Description: Puts the target 28F001BX in Read Array Mode. This function 


/* might be used, for example, to prepare the system for return to code 
/* execution out of the flash memory after program or erase algorithms 
/* have been executed off-chip 

j* Inputs: None 


/* Outputs: None 


/* Returns: Nothing 


/* Device Read Mode on Return: Array 
fFOSSS ELSES FERS AA ESS LE ESS ESS ELE SAK SE LESS ESTEE ELE ESE EES ELE ES CES EEL ESTES EOS TELE SEE J 


#define RDARRAY 


#define SYSADDR 0 


int rdmode() 


byte far *tempaddr; 


tempaddr 
*tempaddr 
return; 


4-242 


OXFF 


(byte far*) SYSADDR ; 


RDARRAY ; 


/* Read Array command 

/* This constant can be initialized to any 

/* address within the memory map of the target 
/* 28FOO1BX and is alterable depending on 

/* the system architecture 

/* Pointer variable used to write commands to 

f* . device 

/* Write Read Array command to 28F001BX 


“/ 
"y 
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a 
*f 
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sf 
a 
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“F 
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*/ 
*/ 
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/* Function: Rdbyte 


/* Description: Reads a byte of data from a specified address and 
/* returns it to the calling program 
/* Inputs: raddr: Target address To be read from 


/* Outputs: rdata: Data at the specified address 


/* Returns: Nothing 


/* Device Read Mode on Return: Array 
[PVHSHESA LESSEE LEE SLELE EVE SELES SEAGRASS PASEALATESS HEFT EEE GSS KET EKS ERAGE KER SES ff 


#define RDARRAY OXFF 
int rdbyte (rdata,raddr) 
byte *rdata; 

byte far *raddr; 

{ 


*raddr = RDARRAY; 


*rdata = *raddr; 
return; 


/* 


/* 
/* 
| hi 


/* 
/* 
/* 
/* 


Read array command 


Returns data read from the device at 
specified address 
Raddr is the target address to be read from 


Write read array command to an address within 
the 28FOO1BX memory map (in this case the 
target address) 

Read from the specified address and store 


"ft 
a 
oR 
"Sp 
"e 
“s 
a 


a 
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/* Function: Vppup 
sf Description: Ramps the Vpp Supply to the target 28FO01BX to enable 


#? programming or erase. This routine can be tailored to the individual 
/* system architecture. For purposes of this example, I assumed that a 
f® System Control Register existed at system address 20000 hex. 

/* with the following definitions: 

/* 

j* Bit 7: Vpph Control: 1 = Enabled 

y* 0 = Disabled 

/* Bit 6: PWD Control: 1 = PowerDown Enabled 

/* O = PowerDown Disabled 

/* Bits 5-0: Undefined 

/* Inputs: None 


/* Outputs: None 
/* Returns: Nothing 
j* Device Read Mode on Return: As existed before entering the function. 


/* Part is now ready for program or erase command sequence 
FPCTOCEKSE STIELAL ESET FED ERASE CERERS FSSA S SE SES ELE SOFAS SS SHS TSS SS SSE SOF ELS OR ELE SPSS SS 


#define VPPHIGH 
#define SYSCADDR 


int vppup() 


byte far *contaddr; 


contaddr = 
*contaddr = 


return; 
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(byte far*)SYSCADDR; 
*contaddr | VPPHIGH; 


0X80 
OX20000 /* 


/* 


Bit 7 = 1, Vpp elevated to Vpph 
Assumed system Control Register Address 


Pointer variable used to write data 
to the System Control Register 


Read current Control Register data, 
"OR" with constant to ramp Vpp 


i 
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/* Function: Vppdown */ 
/* Description: Ramps down the Vpp supply to the target 28F001BX to o7 
/* disable programming/erase. See above for a description of the */ 
/* assumed system Control Register. */ 
/* Inputs: None */ 
/* Outputs: None al i 
/* Returns: Nothing "7 
/* Device Read Mode on Return: As existed before entering the function. Part */ 
/* now has high Vpp disabled. If program or erase was in progress when */ 
/* this function was called, it will complete unsuccessfully with Vpp low error */ 
/* in the Status Register. j */ 


fUFFESS TES ESE EESESS SELES SVE STELLA LRELS CHS ELSES CLEC RALS STETEC ALS SFEAAA CLCLTAES EEE SSS 


#define VPPDWN OX7F /* Bit 7 = 0, Vpp lowered to Vppl */ 
#define SYSCADDR OX20000 /* ASsumed system Control Register Address “7 


int vppdown() 


{ 

byte far *contaddr; /* Pointer variable used to write data to the * 
/* system Control Register */ 

contaddr = (byte far*)SYSCADDR; 


*contaddr = *contaddr & VPPDWN; 
/* Read current Control Register data, "AND" with * f 
/* constant to lower Vpp */ 


return 5 
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/* Function: Pwdon 

/* Description: Toggles the 28FO001BX RP# pin low to put the device in Deep 
/* PowerDown mode. See above for a description of the assumed 

/* system Control Register. 

/* Inputs: None 


/* Outputs: None 


/* Returns: Nothing 

/* Device Read Mode on Return: The part is powered down. If program or erase 
* was in progress when this function was called, it will abort with 

/* resulting partially programmed or erased data. Recovery in the form of 
/* repeat of program or erase will be required once the part 

/* transitions out of powerdown, to initialize data to a known state. 


St 
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#define PWD 0X40 /* Bit 6 = 1, RP# enable 
#define SYSCADDR 0X20000 /* Assumed system Control Register Address 


int pwdon() 


byte far *contaddr; /* Pointer variable used to write data to the 
/* system Control Register 
contaddr (byte far*) SYSCADDR; 


*contaddr = *contadar | PWD; /* Read current Control Register data, "OR" with 


/* constant to enable Deep PowerDown 
return ; 
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/* Function: Pwdoff 
/* Description: Toggles the 28FO01BX RP# pin high to transition the part 


ff? out of Deep PowerDown. See above for a deScription of the assumed system 
/* Control Register. 
/* Inputs: None 


/* Outputs: None 
f* Returns: Nothing 


/* Device Read Mode on Return: Read Array mode. Low voltage is removed 
/* from RP#. 28FOO1BX output pins will output valid data time tPHQV 
/* after the RP# pin transitions high (reference the datasheet AC 

/* Read Characteristics) assuming valid states on all other control 
j* and power Supply pins. 


*/ 
*F 
*/ 
vi 
*f 
*} 
a 
“s 
*/ 
od 
a 
"F 
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#define PWDOFF OXBF /* 
#define SYSCADDR 0X20000 /* 


int pwdoff() 


{ 


byte far *contaddr; /* 
/* 
contaddr = (byte far*)SYSCADDR; 
*contaddr = *contaddr & PWDOFF; /* 
/* 
return; 


Bit 6 = 0, RP# disabled 
Assumed system Control Register Address 


Pointer variable used to write data to the 
system Control Register 


Read current Control Register data, "AND" 
constant to disable Deep PowerDown 


with 


i 
“7 
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APPENDIX B 
MS-DOS ROM VERSION OVERVIEW 


Technical Highlights 


(Taken from Microsoft Product Overview) 


RAM Economy 


Because MS-DOS ROM Version executes from ROM, 
only 15 KB of system RAM space is required for MS- 
DOS. For a typical user, this will result in a savings of 
about 40 KB of RAM over disk-based MS-DOS. As a 
result of this savings, the user is able to run more pro- 
grams and work with larger data files with the ROM 
Version than with disk-based MS-DOS. Instant-On 
MS-DOS ROM Version provides a significant reduc- 
tion in “boot time’’, or the amount of time it takes from 
the completion of the power-on self test until a DOS 
prompt appears. With the ROM Version, this typically 
takes one second. 


No End-User Installation 


MS-DOS ROM Version is pre-installed by the OEM 
(original equipment manufacturer) in the system, thus 
freeing end users from the task of installing MS-DOS. 


Adaptable to OEM Hardware Platforms 


MS-DOS ROM Version is structured such that it al- 
lows the OEM to include a specific routine to deter- 
mine which drive to boot from and any specific param- 
eters if booting from the ROM drive. This makes it 
possible to easily port the ROM Version to a wide vari- 
ety of hardware environments. MS-DOS ROM Version 


4-248 


is also positioned independent, in that it can reside any- 
where in the “reserved” space (the area between 
640 KB and 1 MB). This provides an additional Ver- 
sion to the specific requirements of the OEM’s hard- 
ware platform. 


ROM Economy 


MS-DOS ROM Version occupies only 62 KB of ROM 
space, thus minimizing the amount of ROM that an 
OEM must include in the system. Three modules reside 
in the reserved space: COMMAND.COM, IO.SYS and 
the DOS Kernel. All three are position independent, so 
an OEM can decide where to place these modules in the 
reserved area. 


National Language Support 


Microsoft offers a full compliment of localized version 
of MS-DOS ROM Version, including Kanji and Chi- 
nese translations. 


Ease of Development 


As PCs become the engines for many embedded appli- 
cations, manufacturers would like to develop new ap- 
plications utilizing existing PC software tools. MS-DOS 
ROM allows manufacturers to take full advantage of 
these tools. For instance, a programmer can develop 
and debug an application onto a PC subsystem which 
may be embedded into a larger system. This benefit 
translates into a cost savings when developing a solu- 
tion for vertical markets. 
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APPENDIX C 
BIOS VENDOR INFORMATION 


American Megatrends Inc. (AMI) This list is intended for example only, and in no way 
1346 Oakbrook Drive, Suite 120 represents all companies that support BIOS software. 
Norcross, GA 30093 \ Since this industry developes many new solutions each 
(404) 263-8181 year, Intel recommends that the designer contact the 
vendors for their latest products. Intel will continue to 
Award Software Inc. work with BIOS vendors to develop optimum solutions. 
130 Knowles Drive Intel Corporation assumes no responsibility for circuit- 
Los Gatos, CA 95030 ry or software other than circuitry embodied in Intel 
(408) 370-7979 products. No software patent licenses are implied. 


Phoenix Technologies, LTD. 
40 Airport Parkway 

San Jose, CA 95110 

(408) 452-6500 


Systemsoft Corporation 
313 Speen Street 
Natick, MA 01760 
(508) 651-0088 
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APPENDIX D 
MICROPROCESSOR/MICROCONTROLLER 
COMPATIBILITY CHART 


i960 CA Microprocessor 


28F001BX-T 28F001BX-B 


REVISION HISTORY 


| Number | Description 


Changed PWD # to RP# to match JEDEC naming conventions. 
Updated RP # control circuitry of Figure 7. 
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1.0 INTRODUCTION 


PC BIOS has been migrating to flash-based designs 
with the introduction of highly optimized flash memory 
architectures. The first phase of this shift in paradigm 
was from ROM/EPROM-based BIOS to Bulk Erase 
Flash memory-based BIOS to provide for in-system up- 
datable BIOS and hence an easy update capability 
when BIOS changes are required. 


The second phase improved the basic flash design to 
migrate towards boot block flash memory architecture 
with the Intel 28FOO01BX Flash Memory. This im- 
provement enabled the implementation of additional 
features and provided a true design capability for porta- 
ble PC BIOS. 


The third phase of this paradigm shift now starting to 
evolve, deals with the need to grow beyond the tradi- 
tional BIOS space limit of 128 Kbytes imposed by the 
original PC architecture to accommodate the advanced 
features of today’s portable and desktop systems. 


This application note describes in detail this third phase 
in BIOS hardware and software implementation. Spe- 
cifically it will investigate why BIOS needs to grow be- 
yond the 128 Kbyte code size. Then, a design example 
using the Intel 283F200BX Boot Block Flash Memory 
will be explained in terms of both hardware and soft- 
ware. Finally, low voltage PC BIOS designs incorporat- 
ing 3.3V components are described. 


2.0 PC BIOS TODAY AT THE 
128 KBYTE CODE SIZE LIMIT 


The Basic Input/Output System (BIOS) code is the 
lowest system level software which manages the inter- 
action between all hardware components (CPU, Chip- 
Sets and I/O) with all software modules (Operating 
Systems and Applications Code). BIOS manages many 
functions in a PC, such as Power-On Self Test (POST), 
input vector creation, I/O services and system initiali- 
zation. Therefore BIOS is the essential interface layer 
for full system functionality and compatibility. 


The original PC architecture, developed in 1981, put 
restrictions on the size and mapping of the BIOS code 
which was then a very simple piece of software (on the 
order of 32 Kbytes for the original BIOS code). It was 
located at the top of the PC’s (8088) memory map 
which at the time was a maximum of 1 Mbyte. 
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Then in 1984, the PC AT (80286) BIOS was expanded 
another 32 Kbytes for a total of 64 Kbytes. Subsequent- 
ly, towards the late 1980s, more elaborate BIOS set-up 
utilities started to be an integral part of the BIOS code. 
In addition, personal computer manufacturers designed 
custom features into their BIOS code to offer more sys- 
tem flexibility. This increase in code complexity ex- 
panded the AT BIOS code another 64 Kbytes (for a 
total of 128 Kbytes) To occupy the total BIOS reserved 
space in the | Mbyte memory map. 


In the DOS memory map, BIOS is mapped down from 
the top of the 1-Mbyte address space (FOOOOH to 
FFFFFH). Additional BIOS code space is available for 
future enhancements from EOO00H to EFFFFH. The 
next 256 Kbytes in the DOS memory map are reserved 
for adapter space to accommodate add-in boards (for 
enhanced graphics cards for instance). Finally the re- 
maining 640 Kbytes are reserved for the user to load 
his/her applications for execution. See Figure 1 for a 
graphical description. 


3.0 WHY BIOS CODE WILL GROW 
BEYOND 128 KBYTES 


As advances in computer design affect both desktop 
systems (with the addition of EISA, PCI and on-board 
SCSI capabilities) and portable systems (with the addi- 
tion of advanced power management capability and I/ 
O cards), the need for larger amounts of non-volatile 
memory space becomes evident. 


A Notebook or a Palmtop computer design, for in- 
stance, may put the operating system, the system man- 
agement code, set-up or utility programs into the non- 
volatile memory area to conserve precious RAM space 
for applications. 


Additionally, Video BIOS can also be mapped into the 
Flash BIOS area. 


Therefore, to implement advanced capabilities and pro- 
vide new features (as described above) into powerful 
mobile computers, the 128 Kbyte BIOS code size limit 
had to be removed as it shall be explored in the next 
section. 


The BIOS of today and the future must adapt to the 
new requirements of portable PC designs and take ad- 
vantage of the new capabilities of low power PC chip- 
sets and I/O devices to achieve the highest performance 


‘and longest battery life at the lowest system cost. 
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1 MBYTE DOS MAP 


BIOS CODE 
INTEL 28FO001BX-T 


ADDITIONAL BIOS SPACE BOOT BLOCK FLASH 
MEMORY MAP 


(1024K) FFFFFH 


(960K) EFFFFH 


EQOQOOH 


(896K) DFFFFH 
BOOT RECOVERY CODE 
ADAPTER SPACE 


AND GRAPHIC SPACE PARAMETER BLOCK 
PARAMETER BLOCK 
(640K) AOOOOH 


N 
MAIN BIOS CODE 
USER AREA 


292098 -1 


00000H 


Figure 1. 128 Kbyte BIOS Code Segmentation in 1-Mbyte DOS Memory Map 
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3.1 Advanced Power Management 


High integration CPUs and chip-sets allow for the de- 
sign of light, small form factor portable computers with 
long battery life. 


BIOS is the ideal place for implementing the power 
management techniques pioneered with the Intel386SL 
Microprocessor Superset. BIOS software vendors have 
implemented APM code for the latest generation of 
Notebook PCs. 


This added level of functionality imposed on the BIOS 
code increases the need for larger code space beyond 
the traditional 128 Kbyte BIOS implementations seen 
in today’s portable systems. 


APM code typically requires an additional 32 Kbyte of 
code space beyond the basic 64 Kbyte standard BIOS. 
Therefore, with the addition of APM, BIOS code grows 
to 96 Kbytes. 


3.2 Optimizing New Portable 
Applications 


With the implementation of PCMCIA cards for non- 
volatile file storage (with flash memory cards) and the 
ability to communicate over a telephone line (with mo- 
dem cards), mobile computers have truly become pow- 
erful tools on the road. 


The establishment of a common PC card standard for 
full system compatibility is described in the PCMCIA 
Standard release 2.0 (Personal Computer Memory 
Card International Association). Intel has developed a 
similar set of specifications fully compatible with the 
PCMCIA release 2.0 standard called the Exchangeable 
Card Architecture (ExCA). In order to implement card 
capability in a portable computer, additional BIOS 
code called Socket Services is minimally required to 
manage the system card functionality. To implement 
the specifications, socket services needs an additional 
16 Kbyte of code space. 


Furthermore, in the pen-based PC applications, there 
are even greater BIOS requirements to design-in unique 
features such as: pen extensions, touchscreen capability 


AP-363 


and character recognition interface code. These new 
features require the implementation of additional BIOS 
code (may be 16 Kbytes to 32 Kbytes). 


To take full advantage of Desktop system capabilities 
and performance while still having a portable computer 
to take on the road, docking station designs were con- 
ceived. This added level of complexity for the portable 
computer increases the code required in a basic system 
BIOS. 


3.3 Putting Microsoft MS-DOS 5.0 
Operating System ROM Version 
into the BIOS Chip 


Additionally, MS-DOS 5, ROM version is now becom- 
ing a standard in virtually all diskless sub-notebook, 
notebook and pen PC implementations. Many factors 
contribute to this approach. Chief among them is the 
reduced disk access and the resulting longer battery 
life. Another factor is the instant boot capability which 
is essential in certain applications. 


Today’s MS-DOS 5, ROM version occupies 64 Kbytes 
of code space as specified from the Microsoft Product 
Description. | 


3.4 Relocated Resident VGA Code: 
VIDEO BIOS 


As described above in section 3.0, video BIOS can also 
be mapped into the system Flash BIOS memory allow- 
ing the entire system non-volatile storage requirements 
to be satisfied with one Flash device. Resident VGA 
BIOS code takes approximately another 32 Kbytes of 
memory space. 


In summary, adding all the above code size require- 
ments, the resulting BIOS storage area increases from 
the initial 128 Kbyte requirement to somewhere be- 
tween 208 Kbytes (without pen extensions) to 240 
Kbytes (including a pen input capability). 


There are already portable designs today which have 


filled a 256 Kbyte code space to accommodate some of 
the above mentioned needs. 
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4.0 HARDWARE DESIGN FOR A 
256 KBYTE BIOS 


4.1 Intel 28F200BX/002BX Boot Block 
Flash Memory Family 


Building upon the wide acceptance of the 
Intel28FO001BX 1 Mbit flash memory for BIOS designs, 
a new family of higher density flash components is now 
available to solve the PC designer’s need of implement- 
ing extended BIOS code beyond 128 Kbytes. 


These new flash memories at the 2 Megabit density lev- 
els, are structured around the same boot block architec- 
ture as the Intel 28FO01BX and are therefore compati- 
ble. They provide block erasure capability, boot code 
hardware protection and very low power consumption 
as in the case of the 28FOO1BX. 


In addition, they incorporate new features to simplify 
the device interface and allow the system designer to 
optimize platform designs. 


These new features are summarized as follows: 


© User selectable 8-bit or 16-bit read/write operation 
(28F200BX) 


@ 6Ons access time performance 


® 16 Kbytes Boot Block space which is hardware pro- 
tected 


(Word Addresses) 


16-Kbyte BOOT BLOCK 


8-Kbyte PARAMETER BLOCK 


1FFFFH 


1E000H 
1DFFFH 


1DO00H 
1CFFFH 


1C000H 
1BFFFH 


8-KByte PARAMETER BLOCK 


96-Kbyte MAIN BLOCK 


10000H 
OFFFFH 


128-Kbyte MAIN BLOCK 


00000H 


Valid Addresses in X16 Mode (BYTE# = 1): AO-A16 
Valid Addresses in X8 Mode (BYTE# = 0): 
A-1 (lowest order address) and AO-A16 


28F200BX-T Top Boot Map 
Figure 2. 28F200BX-T/002BX-T Memory Maps 
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e Two, 8 KBytes Parameter Blocks 


© One, 96 KByte Main Block 
One, 128 KByte Main Block 


e 8-bit only operation and packaging for space sensi- 
tive applications (28F002BX) 


In this section, we will describe these new features in 
more detail and discuss their system applicability. 


The blocking scheme, while still of the boot block type, 
is expanded by defining additional blocks (2 main 
blocks) to allow for software modularization and a self- 
contained design. 


As the size of the BIOS code stored in any one device 
grows due to the complexity and high integration of 
chip-sets, so does the “kernel” code stored in the boot 
section. The boot and parameter blocks were accord- 
ingly doubled in size in comparison to the 28FO01BX 
device. The two parameter blocks of 8 KBytes each 
allow the PC designer to store BIOS extensions or Bat- 
tery-Backed SRAM configuration data (CMOS RAM, 
EISA configuration parameters). The two main blocks 
are used to store the main BIOS code in modular fash- 
ion if so desired for future easy updates. These main 
blocks can also be used to store ROM-executable Oper- 
ating System software such as MS-DOS 5, ROM ver- 
sion or drivers and utilities. Refer to Figure 2 for the 
block locations for both the 28F200BX-T and 
28FO02BX-T. 


(Word Addresses) 


16-Kbyte BOOT BLOCK 


8-Kbyte PARAMETER BLOCK 


3FFFFH 


3C000H 
3BFFFH 


3A000H 
39FFFH 


8-Kbyte PARAMETER BLOCK 


38000H 
37FFFH 


96-Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128-Kbyte MAIN BLOCK 


00000H 


28F002BX-T Top Boot Map 
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In addition, the 28F200BX/002BX devices incorporate 


new capabilities desired by today’s sophisticated PC de- 
signers. 


The byte-wide or word-wide feature available as a de- 
signer-selectable option gives the ability to interface to 
an 8-bit or 16-bit wide bus. The performance and hard- 
ware goals of some systems may require 16-bit BIOS 
data bus. A system with a small amount of RAM and a 
large amount of flash memory-based operating system 
code for example, may require a 16-bit BIOS data bus 
to maintain a high performance level of operation. 


The high access speed of these new devices, which for 
the first time break the 60 ns barrier at the 2M and 4M 
densities, is another big advantage the PC designer can 
fully exploit to increase system performance and ac- 
ceptance in the marketplace. For example, a PC design- 
er may choose to execute BIOS directly out of flash 
memory instead of shadowing to system RAM as well 
as execute MS-DOS 5, ROM version out of flash for 
instant-on capability and to achieve better overall sys- 
tem performance. 


Block erasure allows independent modification of code 
and data and maximum flexibilty in production as well 
as after the system is shipped. The boot block, which is 
hardware protected, insures that minimal BIOS code is 
present to always boot up the system successfully. The 
16 Kbyte boot block is protected from alteration during 
system power excursions by a high voltage pin. This 
write protection pin called RP# has to transition to 
12V with the normal Vpp voltage pin to allow for boot 
block write and erase operations. 


If systems are designed with the ability to jumper or 
switch RP# to high voltage (12V), guaranteed full non- 
volatility of the boot code is achieved. This feature al- 
ways guarantees system recovery from power failure 
and provides the security needed for the end user when 
performing BIOS code updates. 


To meet the crucial needs of lower power consumption, 
the 28F200BX/002BX devices incorporate a deep-pow- 
er down current mode activated through the RP# pin 
under the TTL/CMOS level control. When this pin 
transitions to ground the device typically consumes 
1 microwatt through the Vcc supply pin. 


In addition, the 28F200BX/002BX devices include an 
Automatic Power Savings feature during active mode 
of operation. This feature allows the memory chip to 
put itself in a very low current state when it is enabled 
but not accessing a new memory location. 
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The 28F200BX/002BX devices incorporate an internal 
Write State Machine, Command User Interface and a 
Status Register to fully control the program and erase 
operations and greatly simplify the user write and erase 
algorithms and hence the update code procedure. They 
also include an erase suspend feature which allow the 
system to service interrupts and access the device dur- 
ing BIOS code updates (refer to Appendix B). 


Finally, the 28F200BX/002BX, 2-Megabit devices 
have an equivalent 4-Megabit boot block flash memory 
family of devices called the 283F400BX/004BX, allow- 
ing for easy density upgrade and total compatibility be- 
tween systems using both types of memories. Refer to 
the documentation mentioned in the reference section 
of this application note. 


Figure 3 is a block diagram description of the 
28F200BX/002BX products. 


4.2 Extended Flash BIOS Design 
Example 


This design example focuses primarily on how to inter- 
face the Intel 28F200BX-T or 28FO02BX-T Boot Block 
flash memories to the Intel386SL Microprocessor Su- 
perset in a 16-bit wide or an 8-bit wide configuration 
respectively. This is an extended BIOS design example 
which demonstrates how the barrier of the 128-Kbyte 
BIOS size memory is eliminated, The design principles 
in this example apply to designs incorporating chip sets 
interfaced to SL Enhanced CPUs. Figure 4 shows an 
interface diagram of the Intel 28F200BX-T Boot Block 
Flash memory (128 K x 16) to the Intel386SL Micro- 
processor superset. Figure 5 shows an equivalent inter- 
face diagram of the Intel 23FO02BX-T Boot Block flash 
memory (256 K x 8) to the Intel386SL Microprocessor 
Superset. 


The Intel386SL Microprocessor Superset Flash BIOS 
interface supports up to 256 Kbytes of flash memory 
BIOS (a 2 Megabit flash memory device) to enable the 
system designer to meet specific design goals as de- 
scribed in section 3 above. 


The Intel386SL Microprocessor Superset supports the 
following features: 


® Up to 256 Kbytes flash memory BIOS 
e VGA BIOS mapping into system BIOS 
© 8-bit or 16-bit BIOS interface 


e Programmable number of flash memory wait states 
for read access (from zero to fifteen Wait-States to 
optimize the system performance) 


e BIOS shadowing mechanism 
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Flash BIOS size configurations in the Intel386SL Mi- 
croprocessor Superset system are controlled by pro- 
gramming certain registers located in the normal I/O 
address space. 


When a 256 Kbyte Flash BIOS configuration is pro- 
grammed into the Intel386SL Microprocessor Superset, 
128 Kbytes are directly accessible in the EQOOOH- 
FFFFFH address range. The other 128 Kbytes are de- 
coded at the top of the 16th or 32nd Megabyte of the 
Intel386SL superset address space, i.e., either: 


FCOOO0OH-FDFFFFH or 1FCOO00O0H-1FDFFFFH. 
This extra ROM space is accessed by programming the 
ISA sliding control register to point to one of these two 
areas and then accessing the ISA sliding window in the 
DOOOOH-DFFFFH address range (64 Kbytes). This 
mechanism allows complete access of the 256 Kbytes of 
BIOS code without having to enter the Intel386SL pro- 
tected mode. 


The BIOS code size is used to internally decode the 
ROM address space and generate two chip select sig- 
nals: ROMCSO# and ROMCS1*#, to control the Flash 
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BIOS device. In the case of a single Flash BIOS device, 
only ROMCSO# is needed to drive the CE# chip se- 
lect signal of the flash memory. 


In the diagram of Figure 4 note the following: 


¢ BYTE# signal is set high to enable 16-bit operation 
of the flash device. 


e The highest order system address line SAj¢6 is in- 
verted when FLIP # signal becomes active at boot- 
up time to relocate the boot kernel code at the top of 
the 1 Mbyte memory map for the system to boot 
from it. (See section 4.5). 


© ROM16/8# is set high to enable 16-bit bus opera- 
tions. 


¢ RP# signal is gated by the PWRGOOD signal (for 
reset when power fails) and by system RESET sig- 
nal. 


© Vpp supply voltage is switched to the flash device 
only when BIOS updates are required. 


In addition to the above considerations, note the fol- 
lowing in Figure 5: 


e The highest order system address line SAj7 is also 
inverted when FLIP# signal becomes active at sys- 
tem boot-up time. 


© ROM16/8# is set low to enable 8-bit only bus oper- 
ations. 
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LEGEND: 

XDEN# = X-BUS DATA ENABLE 

XDIR = X-BUS DATA DIRECTION 

SMOUT1,2 = SYSTEM MANAGEMENT OUTPUT CONTROLS 
ROMCS0O# = ROM CHIP SELECT FOR SYSTEM FLASH BIOS 
MEMR# = MEMORY READ 

MEMW# = MEMORY WRITE 

FLIP# = BOOT BLOCK MEMORY MAPPING SIGNAL 

ROM 16/8# = ROM 16 BITS OR 8 BITS 

SD[6:0], SD[15:8] = SYSTEM DATA BUS 

SA0-16 = SYSTEM ADDRESS BUS 

XD7 = X-BUS DATA BIT 7 

PWRGOOD = POWER SUPPLY POWER GOOD SIGNAL 


Figure 4. Key Attributes of this Optimized BIOS Interface 
should be Incorporated in BIOS Designs > 128 Kbytes. 
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LEGEND: 

XDEN# = X-BUS DATA ENABLE 

XDIR = X-BUS DATA DIRECTION 

SMOUT1,2 = SYSTEM MANAGEMENT OUTPUT CONTROLS 
ROMCS0O# = ROM CHIP SELECT FOR SYSTEM FLASH BIOS 
MEMR# = MEMORY READ 

MEMW# = MEMORY WRITE 

FLIP# = BOOT BLOCK MEMORY MAPPING SIGNAL 

ROM 16/8# = ROM 16 BITS OR 8 BITS . 

SD[6:0] = SYSTEM DATA BUS 

SA0-17 = SYSTEM ADDRESS BUS 

XD7 = X-BUS DATA BIT 7 

PWRGOOD = POWER SUPPLY POWER GOOD SIGNAL 


Figure 5. Key Attributes of this Optimized BIOS Interface 
should be Incorporated in BIOS Designs > 128 Kbytes. 
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4.3 ISA Sliding Window 


An ISA sliding window mechanism is similar to the 
Expanded Memory System or EMS mechanism. It al- 
lows the access of extended memory on the ISA bus in 
real mode. Hence, there is no conflict in memory allo- 
cation when the BIOS chip is accessed during system 
power-up. This is a straightforward method of imple- 
menting a 256 Kbyte extended Flash BIOS. Figure 6 
shows how extended memory is accessed with the ISA 
sliding window. This capability is designed into Intel’s 
386SL CPU and should be defined into chip sets sup- 
porting SL enhanced CPUs. 


Therefore to use a 256 Kbyte Flash device the follow- 
ing steps are specified as an example: 


Example: 

Enable support of 256 Kbyte Flash BIOS 
Enable Flash BIOS write access 

One BIOS Flash Bank used 


Program zero Flash wait states (for 16 MHz 
Intel386SL with a 60 ns Intel 28F200BX-T or 
28F002BX-T). 


Program the ISA Sliding Window to access memory 
between FCOOOOH and FDFFFFH. 


if ROM Chip-select decode register is not enabled 
enable ROM chip-select decode register 


enable ISEAWINDOW control register 


intel. 
4.4 The 28F200BX-T/28F002BX-T in 
the 1 Mbyte DOS Memory Map 


In addition, due to the above mapping considerations 
when interfacing a 256 Kbyte flash BIOS chip to any 
chip set or the Intel386SL Microprocessor Superset, it 
is necessary to flip the 256 Kbyte flash memory device 
in half at boot time to relocate the Boot Block in the 
correct physical address at FFFFFH for the 
Intel386SL CPU to boot from it. This is due to the fact 
that the Intel386SL Microprocessor Superset uses the 
bottom 128 Kbytes of the 256 Kbyte Flash chip to map 
down to the real mode 128 Kbyte allocated BIOS 
space. 


Figure 7 shows how the Intel 28F200BX-T flash mem- 
ory device fits in the DOS 1 MByte memory map. The 
same memory map applies to the 28FOO2BX-T device 
when designing an 8-bit only system. 


5.0 SOFTWARE DESIGN 
CONSIDERATIONS 


The subject of BIOS code update is already discussed 
extensively in references [1] and [3]. Appendix A of 
this application note is an example of a flash BIOS up- 
date routine. In this section, we mainly discuss consid- 
erations of code segmentation and describe how the sys- 
tem handles the different pieces of code under various 
conditions. 


16 MBYTE 
(1000000h) 
OFDFFFFH 
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ISA SLIDING 


eee a 


WINDOW 


0000000H 
ISA-BUS 


ADDRESS SPACE sac0n8—p 


Figure 6. ISA Sliding Window and Extended Memory Maps 
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1 MBYTE DOS MAP 


FFFFFH 
(1024K) 


BIOS CODE 


EFFFFH 
INTEL 28F 200BX-T 


BOOT BLOCK FLASH 
MEMORY MAP 


ADDITIONAL BIOS*:SPACE 
(960K) MS ROM-DIS 


ae RERERE ERE TRERLRERES 
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(896K) ADAPTER SPACE 
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ROM 0O/S, UTILITIES, DRIVERS 


OOOH 
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Figure 7. 28F200BX-T/28F002BX-T in the 1 Mbyte DOS Memory Map 
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As explained in section 3, advanced notebook designs 
require a large ROM space to conserve valuable RAM 
space for applications. In addition to the boot kernel 
code and standard BIOS code, one may put the follow- 
ing code modules: 


@ APM code 
e VGA BIOS 
@ ExCA socket services 


® Operating Systems such as Microsoft MS-DOS 5.0 
ROM version 


When designing a 256 Kbyte BIOS system as described 
in this application note using Intel’s 28F200BX/ 
002BX, proper code segmentation is essential to 
achieve optimum system performance. 


We can divide the system’s operating environment into 
either: 


BOOT-TIME CONDITIONS (when system powers- 
up or is rebooted) 


or RUN-TIME CONDITIONS (after boot-up is com- 
plete) 


The code modules described above are used at different 
times during normal system operation. Hence, a segre- 
gation of the code stored in the flash memory is neces- 
sary for proper system operation. 


BOOT-TIME EXECUTION 


The system requires the boot kernel to be present at the 
FFFFFH segment during this portion of the cycle. 


When using the 28F200BX/002BX flash memory, the 
first page present will be the top 128 Kbyte. The rest of 
the first page is used to store APM code, VGA BIOS 
code or ExCA socket services. These code modules are 
then copied from their location below the boot block to 
system RAM for later initialization after the standard 
BIOS has started. 


Once all code modules are copied into RAM, this first 
128 Kbyte page of flash can be swapped out or ex- 
changed with the 2nd 128 Kbyte page which is required 
for run-time execution. 


RUN-TIME EXECUTION 


Standard BIOS code is required to be present from 
E0O0O00H to FFFFFH segment during this time period 
to handle any BIOS calls and maintain proper system 
operation. 


Microsoft MS-DOS 5.0 ROM version code is also re- 


quired to be present so the BIOS can “SCAN” it in as 
an adapter. 
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5.1 16 Kbyte Recovery Code 


The 16 Kbyte recovery code is critical when a BIOS 
update does not ‘successfully complete. The reasons for 
this failure can be divided into two categories: 


1. System power failure during BIOS update 
2. System reset (soft boot) during BIOS update 


The processor will execute recovery code out of the 16 
Kbyte boot block when either power is restored or 
when the system boots up after the reset function. 


The 16 Kbyte size recovery code allows the software 
designer to incorporate as many BIOS system checks as 
possible to implement basic system functionality. 


For instance, these checks may include: 


Cursor Positioning 
Keyboard services 
Time of day service 
Basic System services 


5.2 28F200BX Reprogramming 


Three basic algorithms allow the system designer to 
reprogram the Flash BIOS chip and perform the neces- 
sary tasks for a BIOS update. These algorithms are: 


Automated Byte/Word-wide programming 
Automated Block erase 
Erase Suspend and Resume 


For a description of these algorithms, the reader is en- 
couraged to study reference [5]. Appendix B in this 
application note includes the four flowcharts associated 
with the algorithms. 


To obtain the software drivers necessary to control the 
device reprogramming operations, consult your local 
Intel sales office. 


5.3 Power Management 


Power management is an essential part of any true por- 
table PC design. The design of sophisticated power 
management techniques is becoming a key differentia- 
tor between different machines, and hence is a competi- 
tive advantage for the system integrator. 


To help the system designer with this often difficult 
task of optimizing system performance and battery life, 
the 28F200BX family of products includes three dis- 
tinct low power modes of operation. These are: 


e Standby Current Mode, where the device typically 
consumes 50 pA 
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¢ Automatic Power Savings Feature, where the device 
typically consumes 1 mA 


¢ Deep powerdown Mode, where the device typically 
consumes 0.2 wA 


For a detailed description of these modes of operation, 
consult reference [8]. 


6.0 DESIGNING A 3.3V SYSTEM 


The ability to design 3.3V systems used to be a future 
consideration. Longer battery life and lighter weight 
portable computers are some of the key objectives for 
any portable design. Now, thanks to the increasing 
availability of low voltage components, true low power 
machines are possible to realize in practice. 


6.1 Low Voltage Chips 


The list of 3.3V components available to build the es- 
sential parts of a portable computer is becoming longer 
every day. Semiconductor manufacturers have recog- 
nized the urgent need to supply low voltage chips to the 
portable marketplace. 


The Intel 28F200BX/002BX Boot Block Flash Memo- 
ries are available in 3.3V versions. These low voltage 
versions of the 28F200BX/002BX are functionally 
equivalent to their 5V counterparts and are 100% pin- 
out compatible. So a system converting to 3.3V opera- 
tion can substitute low voltage 2 Mbit chips 
(28F200BX-L/002BX-L) when desired without any 
circuit board modification. 


6.2 Power Savings and Improved 
Battery Life 


The 28F200BX/002BX 3.3V chips reduce the total 
power drawn during normal read operation to less than 
25% of the total power in 5V mode. This is a substan- 
tial savings in current which translates to 25% less bat- 
tery drain and hence longer battery life. 


Similarly, low voltage version of the most popular mi- 
croprocessors reduce the total power dissipated by a 
substantial amount. 


The combination of these current savings plus the other 
system components current reductions improve battery 
life dramatically and allow the mobile PC user to bene- 
fit from weight reduction, longer operating time, lower 
system cost and higher performance. 
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7.0 CONCLUSIONS 


7.1 , Benefits of Extended Flash BIOS 


This application note deals with the concepts of extend- 
ed BIOS implementations in portable PC designs, but it 
can also be easily adapted to desktop PC systems for 
which BIOS code requirements can easily exceed 
128 Kbytes. 


We have attempted to explain the requirements and the 
needs of today’s advanced portable BIOS designs which 
have to meet many difficult and often conflicting re- 
quirements. 


Boot Block flash memory is the ideal storage solution 
to implement the above mentioned features. Further- 
more, as the cost of solid state non-volatile flash memo- 
ry keeps decreasing, the need to switch to these types of 
media for storing extended BIOS, operating system 
software, utilities, and in the future application code, 
becomes more evident and perhaps the only way a PC 
manufacturer can effectively compete by producing the 
best engineered, most optimally designed notebooks, 
palmtop PCs and pen-based computers. 
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APPENDIX A 


Example of a Flash Update Utility 
Pseudo-Code 


This example is for a standard BIOS code and APM 
code update using the 28F200BX/002BX flash device. 
Modify this utility, if required, to suit your particular 
system needs. 


Initialize system (set-up user screen, check battery pow- 
er, check device ID) 


Get BIOS/APM file Options (from floppy or through 
modem) 


If no file present 
Send error message to insert BIOS update floppy, or 
press ESC to exit 


Display BIOS/APM update files, prompt user for 
choice and load to memory 


If file is invalid 
Prompt for correct file or exit 
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Inform user of upcoming event, provide option to con- 
tinue or exit 


If user continues, inform user not to turn off the 
power or soft-reboot system (CNTL-ALT-DEL) 


Erase 28F200BX/002BX device 96-Kbyte main block 
If system interrupt occurs 
Suspend erase operation if flash memory access is 
required 


Resume erase operation of 96-Kbyte main block 


Write new file(s) into flash memory 96-Kbyte main 
block 


Indicate to user that flash reprogramming is complete 


Prompt user to reboot the system to continue normal 
operation 
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APPENDIX B 
28F200BX-T/28F002BX-T Programming Flowcharts 
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see Command Comments 
Operation 
Write 40H, Setup Data = 40H 
Byte Address Program Address = Byte to be 


programmed 


Write Byte Program Data to be programmed 
Address/Data Address = Byte to be 


programmed 


Read Status Status Register Data. 
Register | Toggle OE # or CE # to update 
Status Register 
Check SR.7 


Standby 
1 = Ready, 0 = Busy 


Repeat for subsequent bytes. 


Full status check can be done after each byte or after a 
sequence of bytes. 


Write FFH after the last byte programming operation to 
reset the device to Read Array Mode. 


292098-13 


Full Status Check Procedure 


Bus 


Standby Check SR.3 
1 = Vpp Low Detect 


Standby Check SR.4 
1 = Byte Program Error 


SR.3 MUST be cleared, if set during a program attempt, 


YES 
Byte Program before further attempts are allowed by the Write State 
Successful Machine. 


292098-14 SR.4 is only cleared by the Clear Status Register 
Command, in cases where multiple bytes are programmed 
before full status is checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Automated Byte Programming Flowchart 
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Setup Data = 40H 
Program Address = Word to be 
programmed 


Program Data to be programmed 
Address = Word to be 
programmed 


Status Register Data. 


Toggle OE # or CE# to update 
Status Register 


Standby Check SR.7 
1 = Ready, 0 = Busy 


Repeat for subsequent words. 


Full status check can be done after each word or after a 
sequence of words. 


Write FFH after the last word programming operation to 
292098-15 reset the device to Read Array Mode. 


Full Status Check Procedure 
Sus Command Comments 
Operation 


Standby Check SR.3 
1 = Vpp Low Detect 


Standby Check SR.4 
1 = Word Program Error 


SR.3 MUST be cleared, if set during a program attempt, 
Word Program before further attempts are allowed by the Write State 
Successful Machine. 


292098-16 
SR.4 is only cleared by the Clear Status Register 


Command, in cases where multiple words are programmed 
before full status is checked. 


If error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Automated Word Programming Flowchart 
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Write 20H, 
Block Address 
Write DOH, 
Block Address 
Read Status 
Register 


Suspend Erase 
Loop 
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Full Status Check Procedure 


Vpp Range 
Error 


Command Sequence 
Error 
Block Erase 
Error 


YES 
Block Erase 
Successful 


292098-18 


Bus 
Operation [Command | ___ Comments 


Data = 20H 
Address = Within block to be 
erased 


Data = DOH 
Address = Within block to be 
erased 


Status Register Data. 
Toggle OE # or CE # to update 
Status Register 


Check SR.7 
1 = Ready, 0 = Busy 


Repeat for subsequent blocks. 


Full status check can be done after each block or after a 
sequence of blocks. 


Write FFH after the last block erase operation to reset the 
device to Read Array Mode. 


Check SR.3 
1 = Vpp Low Detect 


Check SR.4,5 


Both 1 = Command Sequence 
Error 


Check SR.5 
1 = Block Erase Error 


SR.3 MUST be cleared, if set during an erase attempt, 
before further attempts are allowed by the Write State 
Machine. 


SR.5 is only cleared by the Clear Status Register 
Command, in cases where multiple blocks are erased 
before full status is checked. 


lf error is detected, clear the Status Register before 
attempting retry or other error recovery. 


Automated Block Erase Flowchart 
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Write BOH Erase Data = BOH 
Suspend 


"Read Status Status Register Data. 
Register Toggle OE # or CE# to 
update Status Register 


Standby Check SR.7 
1 = Ready 


Standby Check SR.6 


1 = Suspended 


Erase Has 
Completed 


Write FFH Read Array Data = FFH 


Done Read array data from block 
Reading? other than that being 
erased. 


YES 


Write DOH Erase Resume | Data = DOH 


Continue Erase 


292098-19 


Erase Suspend/Resume Flowchart 
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APPENDIX C 


List of BIOS software vendors already supporting or announcing their future support for the 28F200BX/002BX 


flash BIOS chips: 


SystemSoft Corporation 
Contact: Cliff Sharin 
508-651-0088 

313 Speen Street 
Natick, MA 01760 


Phoenix Technologies Ltd. 
Contact: Howard Cohen 
408-452-6529 

40 Airport Parkway 

San Jose, CA 95110 


Award Software, Inc. 
Contact: Jeffry Flink 
408-370-7979 (ext. 214) 
130 Knowles Drive 

Los Gatos, CA 95030-1832 
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American Megatrends, Incorporated 
Contact: Tom Rau 

404-246-8612 

1346 Oakbrook Drive, Suite 120 
Norcross, GA 30093 


Quadtel 

Contact: Dale Buscaino 
714-754-4422 (ext. 250) 
3190-J Airport Loop 
Costa Mesa, CA 92626 


intel. ER-26 


ENGINEERING 
REPORT 


The Intel 28F001BX-T and 
28F001BX-B Flash Memories 


BRIAN DIPERT 
OWEN JUNGROTH 
MEMORY COMPONENTS DIVISION 


October 1993 


Order Number: 294010-003 4-273 


The Intel 28F001BX-T and 28F001BX-B Flash Memories 


CONTENTS PAGE CONTENTS PAGE 
INTRODUCTION ....................... 4-275 PISA sos ea oat aes cone 4-279 
Reset-Power Down .................006- 4-279 
TECHNOLOGY OVERVIEW ........... 4-275 
DEVICE RELIABILITY ................. 4-280 
DEVICE ARCHITECTURE ............. 4216-3 Gell Margininig: - .) ong meee eye eee 4-280 
Write State Machine and ’ 
Command/Status Registers .......... —— Erase/Program CyGING +. ccs isis eo de et, 4-281 
internal scilatort <2 ais t eid 2c) fess 4-277 BUMMAR Y) 8 cision Sebaere ee er Co 4-281 
Supply Voltage Sensing ................ 4-277 


res yee 4 ek og, Bede cna Mewes ea 4-278 


4-274 


intel. 
INTRODUCTION 


Intel’s 283F001BX ETOX (EPROM tunnel oxide) flash 
memories add selective block erasure, an integrated 
Write State Machine and powerdown capability to In- 
tel’s standard flash memory product line. Flash memo- 
ry enhances EPROM non-volatility and ease of use 
through electrical erasure and reprogramming. Ad- 
vances in tunnel oxides and photolithography have 
made it possible to develop a double-polysilicon single- 
transistor read/write random access nonvolatile memo- 
ry, capable of greater than 100,000 reprogramming cy- 
cles. The 28F001BX flash memories electrically erase 
all bits in a block matrix via electron tunneling. The 
EPROM programming mechanism of hot electron in- 
jection is employed for electrical byte programming. 


A Command Register/Status Register interface to a 
Write State Machine, internal margin voltage genera- 
tion, power up/down protection and address/data 
latches augment standard EPROM circuitry to opti- 
mize Intel’s 28FO01BX family for microprocessor-con- 
trolled reprogramming. 


Read timing parameters are equivalent to those of 
CMOS EPROMs, EEPROMs and SRAMs. The 120 ns 
access time results from a memory cell current of ap- 
proximately 50 wA, low resistance poly-silicide word- 
lines, advanced scaled periphery transistors and an op- 
timized data-out buffer. 


The dense one-transistor cell structure, coupled with 
high array efficiency, yields a one megabit die measur- 
ing 235 by 268 mils. 


TECHNOLOGY OVERVIEW 


Intel’s ETOX flash memory technology is derived from 
its standard CMOS EPROM process base. Using 
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advanced 1.0 wm double-polysilicon n-well CMOS 
technology, the 131,072 x 8 bit flash memories employ 
a 3.8 um x 4.0 pm single transistor cell, affording 
equivalent array density as comparable EPROM tech- 
nology. The flash memory cell structure is identical to 
the EPROM structure, except for the thinner gate (tun- 
nel) oxide. Figure 1 compares the flash memory cell to 
the EPROM cell. 


EPROM Cell 
SECOND LEVEL +6 


POLYSILICON \Q | 


VS 


FIRST LEVEL 
POLYSILICON 
(FLOATING) 


+VD 


GATE OXIDE 


P-SUBSTRATE 
294010-1 


Flash Memory Cell 
+VG 


POLYSILICON \jQ | 


SECOND LEVEL FIRST LEVEL 


POLYSILICON 
(FLOATING) 


+VD 
GATE OXIDE 


P-SUBSTRATE 
294010-2 


Figure 1. EPROM Cell vs. Flash Memory Cell 
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High quality tunnel oxide under the single floating 
polysilicon gate promotes electrical erasure. All cells of 
a given block are simultaneously erased via Fowler- 
Nordheim tunneling. Applying 12V on the block 
source junctions and grounding the select gates erases a 
given block. The internal Write State Machine (WSM) 
controls the erase algorithm, including block pre-pro- 
gramming before erasure. WSM-controlled erasure, in- 
cluding internal pre-programming, takes 2.1 seconds 
typical for each parameter block and the boot block, 
and 3.8 sec. typical for the main block. 


Programming is accomplished with the standard 
EPROM mechanism of hot electron injection from the 
cell drain junction to the floating gate. Programming is 
initiated by bringing both the select gate and the cell 
drain to high voltage. The internal WSM regulates the 
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internal program algorithm after the correct command 


sequence is written to the 28F001BX. Typical program 
time is 18 ps per byte. 


DEVICE ARCHITECTURE 


Write State Machine and Command/ 
Status Registers 


Intel’s 28FO01BX flash memories contain an on-chip 
Write State Machine that automatically controls erase 
and program algorithms, dramatically simplifying user 
interface. Figure 2 shows the 28FO01BX block dia- 
gram. 
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Figure 2. 28F001BX Block Diagram 
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The WSM simpifies microprocessor control of the 
erase, program, Status Register read/clear, ID read and 
array read operations, without the need for additional 
control pins or the multiplexing of high voltage with 
control functions. The WSM, with its integrated oscil- 
lator, performs a majority of the standard flash memo- 
ry program and erase algorithms automatically. This 
makes system timers no longer necessary and frees the 
system to service interrupts or perform other functions 
during device erase or program. On-chip address and 
data latches minimize system interface logic and free 
the system bus. The Write State Machine accepts array 
read, ID read and Status Register read and clear com- 
mands whenever power is applied to the 28FOO1BX. 
High voltage (12V) on Vpp additionally enables suc- 
cessful program and erase. 


The WSM consists of a Command Register, Status 
Register, State Machine, oscillator, command decoder, 
data latch and address latch. The command decoder 
output feeds the State Machine, enabling the high volt- 
age flash-erase switch, program voltage generator and 
_ erase/program verify voltage generator. 


Functions are selected via the Command Register in a 
microprocessor write cycle controlled by the Chip En- 
able (CE#) and Write Enable (WE#) pins. The rising 
edge of WE# latches the address and data-in registers, 
and initiates an operation. Status Register contents are 
driven to the outputs on the falling edge of CE# or 
Output Enable (OE#), whichever occurs last in the 
read cycle. 


Internal Oscillator 


The Write State Machine is designed using clocked log- 


ic circuits. An on chip ring oscillator generates the 
clock signals. The frequency of a standard ring oscilla- 
tor varies with processing, temperature and supply volt- 
age. The improved design used on the 28F001BX mini- 
mizes these variations. : 


The switching current of each stage in the ring oscilla- 
tor is set by a current reference. This reference current 
varies linearly with Vcc. The trip point of each ring 
oscillator inverter also varies linearly with Vcc. These 
two effects essentially cancel each other out and the 
resulting oscillator period is proportional to RC, with 
only a small dependence on Vcc. 


The value of R is set by an on chip resistor. The value 
of C is set by the gate capacitance of the inverters in the 
ring oscillator. Process variations in the values are re- 
duced by trimming the period of each oscillator during 
manufacturing. The resistor is the only source of tem- 
perature variation. 
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Figure 3 shows how the oscillator period varies with 
temperature and supply voltage. The circuit works for 
supply voltages outside the normal operating condi- 
tions and for military temperatures. 
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Figure 3. Internal Oscillator Frequency 
vs Supply Voltage and Temperature 


Supply Voltage Sensing 


The circuit that generates LOWVcc and LOWVpp is 
shown in Figure 4. Power supply voltages Vcc and 
Vpp are divided down and compared to a reference 
voltage. If the reference voltage is greater than the di- 
vided power supply voltage, the LOWVcc or 
LOWVpp signal will be pulled high. The Vppr level 
generated by the voltage reference is independent of the 
supply voltage to the first order. 
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_ Ep > 
VOLTAGE a4 


LOW Vpp 
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Figure 4. Low Power Detector Circuit 
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The positive power supply to the circuit is provided by 
M1 and M2. The source of M1 and M2 will be pulled 
up to the maximum of (Vpp-V7Nn) and (Vcc-Vtw). 
Vn is the threshold of an implanted N channel device, 
about 0.9V. Vrw is the threshold of a native N channel 
device, about OV. This scheme ensures that the circuit 
will work regardless of the applied supply voltages. 


The LOWV cc signal not only goes to the erase circuits, 
but also to the programming circuits and to the control 
logic to prevent any accidental writes to the array. The 
LOWVpp signal goes to the Write State Machine. If 
Vpp is detected as being low during a write, the low 
Vpp bit will be set in the Status Register. 


Erasure 


Erasure is achieved through a two-step write sequence. 
The erase setup code is written to the Command Regis- 
ter in the first cycle. The erase confirm code is written 
in the second cycle. The block to be erased is specified 
by writing both commands to any address within the 
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block. The address is latched and decoded internally by 
the 28F001BX, and erase of the desired block is subse- 
quently enabled. The rising edge of this second WE# 
pulse initiates the erase operation. The boot block will 


not erase unless the RP# or OE# signal is brought to 
high voltage VyH. 


The State Machine triggers the high voltage flash-erase 
switch, connecting the 12V supply to the source of all 
bits in the specified block, while all wordlines are 
grounded. The organization of the block source 
switches is shown in Figure 5. Fowler-Nordheim tun- 
neling results in the simultaneous erasure of all bits in 
the addressed block. 


The block source switch controls the source voltage of 
the bits in a particular block. This circuit is shown in 
Figure 6. During erase, M2 is off and M1 pulls the 
source to Vpp. When not in erase, M1 is off and M2 
pulls the source to ground. The high voltage latch 
formed by M4—M7 converts the low voltage ERASE 
signal to a high voltage signal that turns M1 off or on. 
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Figure 5. Array Erase Blocking 
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Figure 6. Block Source Switch 
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The tunneling that occurs during erase requires only a 
small amount of current. However, the grounded gate 
initial erase current that occurs on the source of every 
bit in the array is large. M1 is made large enough to 
supply this current and still keep the voltage on the 
source high enough for fast erase time. 


The LOWVcc signal protects the array from being 
erased when Vpp is at a high voltage but Vcc is a low 
voltage. When this occurs, M3 will pull the block 
source to ground. The high voltage latch will be forced 
into the state that turns M1 off by M8. 


After receiving the erase command sequence, the WSM 
automatically controls block precondition (program- 
ming of all bytes to OOH within the chosen block), erase 
pulses and pulse repetition, timeout delays and byte-by- 
byte verification of all block addresses using the inter- 
nally-generated erase margin voltage. The internal 
erase and verify operations continue until the entire 
block is erased. System software need only poll the 
Status Register to determine when the WSM has suc- 
cessfully completed the erase algorithm. 


Programming 


Programming follows a similar flow. The program set- 
up command is written to the Command Register on 
the first cycle. The second cycle loads the address and 
data latches. The rising edge of the second WE# pulse 
initiates programming by applying high voltage to the 
gates and drains of the bits to be programmed. 


As with erasure, the WSM controls program pulses and 
pulse repetition, timeout delays and byte verification. 
Program and program verify (at the internally-generat- 
ed verify voltage) continue until the byte is pro- 
grammed. System software, polling the Status Register, 
is informed of programming state thru specific status 
bits. 
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Reset-Power Down 


The 28FO01BX has a deep power down mode that re- 
duces Icc and Ipp to typically 0.05 wA and 0.8 pA, 
respectively. When RP# is low, the part is in deep 
power down mode. When RP # is high, the part can be 
placed in an active or standby mode by state of the 
CE# pin. 


The deep power down mode is similar to the standby 
mode except that more circuits are turned off. This 
means that much less power is consumed; it also means 
that it takes longer for the part to transition into the 
active mode. 


A diagram of the power down circuit is shown in Fig- 
ure 7. The TTL buffer formed by M1-—M3 enables the 
low power detect circuits, the redundancy address flash 
bits and the CE# TTL buffer formed by M4—M6. In 
previous Intel flash chips these circuits were always en- 
abled. The time for these circuits to turn on determines 
the RP# access time and write specifications. 


RP# will function properly with TTL level inputs. 
However, to get the lowest possible power consump- 
tion, full CMOS levels should be used. If voltage on the 
gate of M3 raises above its threshold voltage of 0.9V, it 
will turn on and draw current. Input voltages in the 
0.7-0.9 range could cause enough subthreshold con- 
duction in M3 to exceed the deep power down current 
specification. This is why the input voltage for RP# is 
specified as GND +0.2V. 


The use of RP# during system reset is important with 
automated write/erase devices. When the system comes 
out of reset it expects to read from the flash memory. 
Automated flash memories provide status information 
when accessed during write/erase modes. If a CPU re- 
set occurs with no flash memory reset, proper CPU 
initialization would not occur because the flash memo- 
ry would be providing the status information instead of 
array data. Intel’s Flash Memories allow proper CPU 
initialization following a system reset through the use 
of the RP# input. In this application RP# is con- 
trolled by the same RESET # signal that resets the sys- 
tem CPU. 
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Figure 7. Power Down Circuits 
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Cell Margining 


Erase and program verification ensure the data reten- 
tion of the newly altered memory bits. The cell margin- 
ing performed by the WSM during the verify phase of 
the automated algorithms is more reliable than histori- 
cal EEPROM schemes, as margining tests the amount 
of charge stored on the floating gate. 


Intel’s 28F001BX flash memories employ a unique cir- 
cuit to internally generate the erase and program verify 
voltages. Figure 8 shows a simplified version of the cir- 
cuit. The circuit consists of a high voltage switch and 
the verify voltage generator. Transistors M1 through 
M4 constitute the high voltage switch which discon- 
nects Vpp from the resistor when the device is not in 
the verify mode. The verify voltage generator includes a 
resistor divider and a buffer. Internal margin voltage 
generation maintains microprocessor compatibility by 
eliminating the need for external reference voltages. 
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Figure 8. Erase/Program Verify Generator 
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Erase/Program Cycling 


One of the most significant aspects of 28F001BX flash 
memories is their capability for 100,000 erase/program 
cycles per block. Destructive oxide breakdown has been 
a limiting factor in extended cycling of thin oxide 
EEPROMs. Intel’s ETOX flash memory technology 
extends cycling performance through: 


e Improved tunnel oxide processing that increases 
charge carrying capability tenfold; 


@ Reduced oxide area under stress minimizing proba- 
bility of oxide defects in the region; and 


@ Reduced oxide stress due to a lower peak electric 
field (lower erase voltage than EEPROM). 


A typical cell erase/program margin (V;) is shown as a 
function of reprogramming cycles in Figure 9. After 
100,000 reprograming cycles, a 2.5V program read 
margin exists, ensuring reliable data retention. 
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Reliable erase/program cycling also requires proper se- 
lection of the erase V; maximum and maintenance of a 
tight V; distribution. The maximum erased V;, is set to 
3.2V via the internal erase algorithm and erase verify 
circuits. Superior oxide quality gives an erased V; dis- 
tribution width that improves slightly with cycling 
(Figure 10). The tight erase V; distribution gives an 
order of magnitude of erase time margin to the fastest 
erasing cell. 


SUMMARY 


Intel’s ETOX flash memory technology is a break- 
through in adding electrical chip-erasure to high-densi- 
ty EPROM technology. Intel’s 28FO01BX family en- 
hances Intel’s standard flash memory line by adding 
block erase capability, Write State Machine-controlled 
program and erase and deep powerdown mode. Micro- 
processor-compatible specifications, straightforward in- 
terfacing and in-circuit selective alterability using sim- 
ple software command sequences allow designers to 
easily augment memory flexibility and satisfy the need 
for nonvolatile storage in today’s designs. 
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Figure 9. Block V; vs Cycles 
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Figure 10. Erase V; Distribution vs Cycling 
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Figure 11. Block Erase V; vs Erase Time 
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Figure 12. 28F001BX Die Photograph 
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Figure 13. 28F001BX Pinout Configurations 
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Figure 14. 28F001BX Pinout Configurations 
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Columns are number 0 through 511 beginning with the column nearest the X-decoder. Outputs are grouped as 
follows: 
Left Half Array Right Half Array 
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Array Organization 
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Figure 15. Bitline Decoding (Main Block, 28F001BX-T) 


Right Half Array 
109-107 
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Array Organization 
(Parameter Block 1): 


Figure 16. Bitline Decoding (Parameter Block 1, 28F001BX-T) 


Right Half Array 
Array Organization 109-107 


(Parameter Block 2): BL32 — Blé¢3 


Bitlines 
Aas | Ars | Ata | Aiz | Ar | Ao | 100 | 101 | 12 | 103 | 104 | 105 | 106 | 107_ 


NOTES: 
1. Bitline decoding listed is for 28F001BX-T. To convert to 28F001BX-B, invert polarity of addresses A;g—Ajo9 (i.e. 0000000 
becomes 1111100). 
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Figure 17. Bitline Decoding (Parameter Block 2, 28F001BX-T) 


ER-26 mrs intel. 


ies Left Half Array 
Array Organization : 107-105 


(Boot Block): 


Bitlines 


5 
N 


wanna nal? 
waneseaaiP 


ee ee ee ee ee ee ee 
St iO +e GO OC 
tt ck Own OMG 


ee ee ee ee ee ee 


Figure 18. Bitline Decoding (Boot Block, 28F001BX-T) 


NOTE: 
1. Bitline decoding listed is for 28F001BX-T. To convert to 28F001BX-B, invert polarity of addresses Ajg-Ajp (i.e. 0000000 
becomes 1111100). 
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Figure 19. Wordline Decoding (28F001BX-T and 28F001BX-B) 
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Figure 19. Wordline Decoding (28F001BX-T and 28F001BX-B) (Continued) 
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Figure 20. Array Organization 


REVISION HISTORY 


Swapped Figures 9 and 10 
Added Figure 11 

PWD changed to RP # 

for JEDEC standard compatibility. 
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INTRODUCTION 


The ETOX III (EPROM tunnel oxide) 2/4-Mbit fami- 
ly of Intel boot block Flash Memories are a continua- 
tion of boot-top and boot-bottom architectures first in- 
troduced in the 1-Mbit 28F001BX-T and 28F001BX-B 
devices. Top (-T) and bottom (-B) boot block offerings 
provide compatibility for microprocessors that boot 
from high or low memory addresses. 


All versions of this new family provide a 16-Kbyte 
hardware-protected boot block, two 8-Kbyte parameter 
blocks and a 96-Kbyte main block. The 2-Mbit prod- 
ucts have an additional 128-Kbyte main block, while 
4-Mbit offerings contain three additional 128-Kbyte 
main blocks. 


Flash memories combine inherent non-volatility with 
in-system alterability of device contents. Selective block 
erasure allows manipulation of data contents within 
one of the seven (or five) mini-array segments without 
affecting data stored in the other six (or four). Ad- 
vances in process control have allowed development of 
a double-polysilicon single-transistor flash memory ca- 
pable of 100,000 write/erase cycles per block. The 
2/4-Mbit boot block family electrically erases all bits in 
a block via electron tunneling. The EPROM program- 
ming mechanism of hot-electron injection is employed 
for high-performance electrical word/byte write as re- 
quired for computing and embedded applications. 


An integrated Command User Interface (CUI) simpli- 
fies microprocessor control of device operations (word/ 
byte write, block erase, erase suspend/resume, Status 
Register read/clear, array read and device identifier 
read). The internal Write State Machine (WSM) con- 
trols all functions and circuits associated with word/ 
byte-write and block-erase operations, including pulse 
widths and repetition, timeout delays, erase precondi- 
tioning and margined verifications. The WSM continu- 
ally updates the internal Status Register during these 
functions. The Status Register is read via outputs 
DQo-DQ?7 providing feedback of WSM activities. 


The CUI and Status Register interface to power-up/ 
down-protection circuitry, address/data latches and the 
WSM. This interface augments first-generation flash 
memory circuitry to optimize Intel’s 2/4-Mbit boot 
block family for microprocessor-controlled word/byte 
write and block erase. 


A deep-power-down mode enables extremely low pow- 
er consumption to augment reduced-power standby op- 
eration. An automatic power savings feature reduces 
Icc during read mode. 
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A 60 ns access time (tacc) results from a memory cell 
current of approximately 70 wA, low-resistance polysil- 
icide wordlines strapped with metal, advanced scaled 
periphery transistors and improved circuit techniques. 


The dense one-transistor cell structure, coupled with 
high array efficiency, yields a 4-Mbit die measuring 295 
by 331 mils and a 2-Mbit die measuring 295 by 221 
mils. 


Word/Byte-Wide Versions 


Intel’s 28F400BX is a 4,194,304-bit non-volatile memo- 
ry organized as either 262,144 words (256K x 16) or 
524,288 bytes (512K x 8). A dedicated BYTE# control 
input provides selection of the desired input/output 


- (I/O) configuration (either x16 or x8) for read opera- 


tions and data writes. 


Intel’s 28F200BX is a 2,097,152-bit non-volatile memo- 
ry organized as either 131,072 words (128K x 16) or 
262,144 bytes (256K x 8). This device also provides 
BYTE# control of I/O configuration. 


The 28F400BX and 28F200BX are available in the 44- 
lead Plastic Small Outline Package (PSOP) and the 56- 
lead Thin Small Outline Package (TSOP). 


Byte-Wide Versions 


Intel’s 28FO04BX is a 4,194,304-bit non-volatile memo- 
ry arranged as 524,288 bytes (512K x 8). Intel’s 
28FOO2BX is a 2,097,152-bit non-volatile memory ar- 
ranged as 262,144 bytes (256K x 8). 


With lower pin counts compared to their x8/x16 equiv- 
alents, the 28FO04BX and 28F002BX allow housing in 
the smaller 40-lead TSOP. 


TECHNOLOGY OVERVIEW 


Intel’s ETOX III Flash Memory technology incorpo- 
rates advances from ETOX I and ETOX II processes, 
and leverages over two decades of EPROM manufac- 
turing experience. Using advanced 0.8 wm double-poly- 
silicon N-well/P-well CMOS technology, the 2/4-Mbit 
boot block flash memories employ a 2.5 wm x 2.9 wm 
single-transistor cell affording array density equivalent 
to comparable EPROM technology, and twice that of 
Intel’s ETOX II process. The ETOX III flash memory 
cell is identical to 0.8 wm EPROM, except for an addi- 
tional source implant which optimizes erase perform- 
ance. Figure 1 shows a cross-section of the flash memo- 
ry cell. 
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Figure 1. Flash Memory Cell 


High-quality tunnel oxide under the single floating 


polysilicon gate promotes electrical erasure. All cells 


within the selected block are simultaneously erased via 
Fowler-Nordheim tunneling. Applying 12V to block 
source junctions and grounding the select gates erases 
all cells within that block. The internal WSM controls 
the automated block-erase algorithm, including pre- 
erase conditioning (i.e. pre-programming all block bits) 
and margin verification, in response to user requests 
relayed by the CUI. WSM-controlled block erasure, in- 
cluding pre-programming, typically ranges from 1.0 to 
2.4 seconds depending on the size of the block selected. 


Word/byte write is accomplished with the standard 
EPROM mechanism of channel hot-electron injection 
from the cell drain junction to the floating gate. Bring- 
ing both the select gate and the cell drain to high volt- 
age initiates programming. The WSM regulates the in- 
ternal word/byte-write algorithm, including margin 
verification, after the correct command sequence is 
written and decoded. Word/byte write typically re- 
quires 9 ps. 


DEVICE ARCHITECTURE 


Array Organization 
Layout of the 2/4-Mbit boot block family is segmented 


as two array planes (see Figure 2). This organization - 


allows improved access times via minimal internal bus- 
ing, thus balancing the need for high speed with the 
requirement of small die size for cost-effective solu- 
tions. In the 4-Mbit family, each array plane is 1024 
rows by 2048 columns. For the 2-Mbit family, each 
array plane is 1024 rows by 1024 columns. Access time 
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is reduced by limiting column length to 1024 cells. The 
polysilicon row is strapped in metal every 512 columns 
to reduce wordline delay. Two row decoders run verti- 
cally along the array plane sides, and column decoders 
run horizontally between array planes. Figure 36 shows 
a die photo of the 4-Mbit family. 


Each array plane is divided into eight I/Os for the 
28F400BX/200BX. The upper plane consists of the 
high-byte I/Os (DQg-DQ)5), while the lower plane 
consists of the low-byte I/Os (DQ9-DQ7). During 
byte-wide operation (BYTE# = ‘“0”) the high-byte 
I/Os are multiplexed through the low-byte I/Os via 
A—j decoding. Data for I/Opo is stored in the left-most 
256 columns (or 128 columns for the 28F200BX) of the 
lower plane, with the next 256 columns (or 128) storing 
data for I/O, etc. Data for I/Og is stored in the left- 
most 256 (or 128) columns of the upper plane, with the 
next 256 (or 128) columns storing data for I/Og, etc. 


For the dedicated byte-wide products (28FOO4BX/ 
002BX), data for a given I/O is divided between the 
upper and lower array planes as decoded by Ajo. Data 
for I/Op is stored in the left-most 256 columns (or 128 
columns for the 28FO02BX) of both the upper and low- 
er planes, with the next 256 columns (or 128) in each 
plane storing data for I/O), etc. 


Since each I/O is a grouping of adjacent columns (256 
or 128), the independently-erasable blocks (seven or 
five) are segmented within each I/O. Each I/O in the 
4-Mbit family is divided into seven blocks; including a 
16-Kbyte boot block, two 8-Kbyte parameter blocks, 
one 96-Kbyte main block and three 128-Kbyte main 
blocks. Each I/O in the 2-Mbit family is divided into 
five blocks; including a 16-Kbyte boot block, two 
8-Kbyte parameter blocks, one 96-Kbyte main block 
and one 128-Kbyte main block. Each block source is 
electrically isolated from the sources of the other six (or 
four) blocks. This allows individual block erase without 
altering data in the other blocks. 


Addresses Ag—Apg select one of 1024 rows. Row ad- 
dress lines are decoded sequentially for selection. Table 
3 lists row address bitmaps. 


Columns are decoded by A;g—Ajo for the 28FOO4BX, 
Ai7—Ajo for the 28F400BX and 28FOO2BX, and Aj¢- 
Ajo for the 28F200BX. 4-Mbit family columns are 
numbered 0-255 for each I/O, and 2-Mbit columns are 
numbered 0-127 for each I/O. Table 4 and 5 lists col- 
umn address bitmaps. 
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ROW DECODER 


ROW DECODER 


Block Memory Map 


Top (-T) and bottom (-B) boot block offerings have 
block address maps which are inverted from one anoth- 
er to provide compatibility for microprocessors that 
boot from high or low memory addresses. Figures 3, 4, 
5 and 6 show 28F400BX-T/B, 28F200BX-T/B, 
28FOO04BX-T/B and 28FO02BX-T/B memory maps. 
The addresses shown in Figures 3 and 4 for the 
28F400BX-T/B and 28F200BX-T/B, decode two bytes 
of data. A; decodes between the two bytes when 
BYTE# is low. 


Write/Erase Automation 


Intel’s 2/4-Mbit boot block Flash Memories contain an 
on-chip Command User Interface. Write State Ma- 
chine, Status Register and address/data latches to dra- 
matically simplify user interface. This combination of 
functional units reduces microprocessor control 
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1/08 | 1/09 | 1/010 | 1/011 | 1/012 | 1/013 | 1/0 14 | 1/0 15 
(1/0 0)* | (1/0 1)* | (1/0 2)* | (1/0 3)* | (1/0 4)* | (1/0 5)* | (1/0 6)* | (1/0 7)* 


COLUMN DECODER 
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Figure 2. 2/4-Mbit Boot Block Family Array Organization ((|/O #)* Denotes 28F004BX/002BxX I/Os) 
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complexity of word/byte-write block-erase, erase-sus- 
pend/resume, Status Register-read/clear, [D-read and 
array-read operations. Figures 7 and 8 show 
28F400BX/200BX and 28F004BX/002BX block dia- 
grams. 


Command User Interface (CUI) 


The CUI consists of a command decoder and command 
register. User requests are decoded and latched in a 
microprocessor write cycle controlled by Chip Enable 
(CE#) and Write Enable (WE#). Status Register- 
read/clear, [D-read and array-read commands are di- 
rectly handled by the CUI. The CUI also accepts 
word/byte-write, block-erase and erase-suspend/re- 
sume commands. WE#’s rising edge latches address, 
command and data-in registers, and requests WSM ini- 
tiation of the selected operation. These on-chip address, 
command and data latches, controlled by the CUI, 
minimize system interface logic and free the system 
bus. 
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Figure 3. 28F400BX-T/B Memory Maps 
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Figure 4. 28F200BX-T/B Memory Maps 
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Figure 5. 28F004BX-T/B Memory Maps 
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Figure 6. 28F002BX-T/B Memory Maps 
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Write State Machine (WSM) 


The WSM processes word/byte-write, block-erase and 
erase-suspend/resume requests received from the CUI. 
The WSM rejects word/byte-write and block-erase re- 
quests if the WSM is currently busy, if Vpp is not at 
high voltage (12V) or if the Low Vpp Status Register 
flag is set (i.e. not cleared from a previous low-voltage 
condition). 


The WSM consists of an integrated oscillator and con- 
trol circuitry. It generates signals which control the 
word/byte-write, block-erase, erase-suspend/resume 
and verify circuits. It also receives feedback from these 
circuits, allowing Status Register updates. The WSM 
and associated circuits perform the equivalent of first- 
generation flash memory program and bulk-erase algo- 
rithms automatically. 
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This eliminates the need for system timers, and frees 
the microprocessor to service interrupts or perform 
other functions during device word/byte-write or 
block-erase operations. 


The WSM provides feedback to the CUI to determine 
when a given command is valid. Although nearly all 
commands are available when the WSM is inactive, 
only status read is valid while the WSM performs a 
word/byte-write operation. During block erase, only 
the read-status and erase-suspend commands are avail- 
able. Read-array, read-status, and erase-resume com- 
mands are valid with the WSM in an erase-suspended 
state. Invalid operations are interpreted as the read-ar- 
ray command when the WSM is inactive or erase sus- 
pended, and as the read-status command when the 
WSM is active in word/byte write or block erase. 


1/0 7 
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Figure 7. 28F400BX/200BX Block Diagram 
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Status Register 


The internal Status Register contains a full complement 
of activity status bits. These bits and their meaning, 
“1/0” are: 


SR.7: WSM status (READY/BUSY #) 


SR.6: Erase-suspend status (ERASE SUSPENDED/ 
ERASE IN PROGRESS # or 
COMPLETED #) 


Block-erase status (ERROR/SUCCESS # ) 
Word/byte-write status (ERROR/SUCCESS #) 
Vpp status (LOW/OK #) 


SR.5: 
SR.4: 
SR.3: 


All bits are set by the WSM, and read via the CUI. The 
WSM can only set SR.3, SR.4 and SR.5; it cannot clear 
them. They remain set until the CUI processes a clear 
Status Register command. There are two reasons for 
operating in this fashion. First is synchronization; the 
WSM does not know when the host CPU has read the 
Status Register, therefore does not know when to clear 
it. 
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Secondly, allowing system software to control reset 
adds flexibility to the way this device may be used. The 
CPU may write several words/bytes, or erase several 
blocks back-to-back, while polling SR.7 to determine 
when the next word/byte-write or block-erase com- 
mand can be given. When all words/bytes are written, 
or all blocks erased, the system polls the other status 
flags to determine if all operations were successful, or if 
an error occurred. While other approaches require the 
controlling microprocessor to watch for non-comple- 
tion of write or erase within a specified time to indicate 
an error, this implementation requires no external sys- 
tem timers or software timing loops. As such, the sys- 
tem can reduce its polling overhead while still identify- 
ing any potential error conditions. 


Status Register contents are driven to device outputs on 
the falling edge of CE# or Output Enable (OE#), 
whichever occurs last in the read cycle. CE# or OE# 
must be toggled to update Status Register contents. 


ISTER 


REG 


COMMAND 
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INTERFACE 
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Figure 8. 28F004BX/002BX Block Diagram 


4-296 


intel. 


internal Oscillator 


The WSM is designed using clocked logic circuits. An 
on-chip ring oscillator generates the clock signals. The 
frequency of a standard ring oscillator varies with pro- 
cessing, temperature and supply voltage. A proven de- 
sign used on the 28FOOIBX-T/B, 28FO08SA and 
2/4-Mbit boot block family minimizes these variations. 


The switching current of each stage in the ring oscilla- 
tor is controlled by a current reference which varies 
linearly with Vcc. The trip point of each ring oscillator 
inverter also varies linearly with Vcc. These two effects 
offset each other, and the resulting oscillator period is 
proportional to RC with only a small dependence on 


Vcc. 


An on-chip resistor sets the value of R. The gate capac- 
itance of the inverters in the ring oscillator sets the 
value of C. Process variations in these values are re- 
duced by trimming the period of each oscillator during 
manufacturing. The resistor is the only source of tem- 
perature variation. ’ 


Supply Voltage Sensing 


Figure 9 shows the LOWVcc and LOWVpp genera- 
tion circuits. Power supply voltages (Vcc and Vpp) are 
divided down and compared to a reference voltage. If 
VREF is greater than the divided power supply voltage, 
the LOWVcc or LOWVpp signal is driven high. The 
generated Vppr level is supply-voltage independent to 
the first order. 


Positive power to the circuit is supplied by M1 and M2. 
M1 and M2 sources are pulled up to the higher of 
(Vpp — Vin) or (Vcc — Vtw)- Vin is the threshold of 
an implanted N-channel device, about 0.9V. Viy is the 
threshold of a native N-channel device, about OV. This 
scheme ensures that the circuit works regardless of the 
applied supply voltages. 


The LOWVcc signal is used by the word/byte-write 
and block-erase circuits, as well as the CUI and WSM. 


| 


LOW Veg 


M1 M2 
LoS > 
+2 
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Figure 9. Low-Power Detector Circuit 
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If LOWVcc is active, the CUI will not accept user 
writes and resets to an array-read condition. The WSM 
is similarly reset by LOWVcc. The LOWVpp signal is 
used by the WSM;; if Vpp drops below the high-voltage 
detector trip point during word/byte write or block 
erase, the Status Register’s low Vpp bit is set and WSM 
operation halts. The system must clear the Status Reg- 
ister before any subsequent word/byte-write or block- 
erase operations can succeed. | 


Deep Power-Down and Device Reset 


The 2/4-Mbit boot block family incorporates a deep- 
power-down mode that reduces Icc and Ipp to typical- 
ly 0.20 wA and 0.07 wA respectively. RP # low selects 
deep power-down. When RP # is high, the device can 
be placed in an active or standby mode depending on 
CE# state. 


Deep power-down is similar to standby except that all 
circuits excluding the RP# buffer are turned off. This 
mode greatly reduces power consumption, but requires 
more time to transition the device into an active mode. 
A read wake-up time (tpygy) is required from RP# 
switching high until output and sense circuitry become 
fully functional and data can be read from the part. 
Similarly, a write wake-up time (tpzyw ) is needed be- 
fore the CUI recognizes writes. After this interval nor- 
mal operation is restored; the CUI is reset to read-array 
mode and the Status Register is cleared to 80H. 


Figure 10 shows a diagram of the power-down circuit. 
The TTL buffer formed by M1-—Ms3 disables the low- 
power detect circuits, the redundancy-address flash bits 
and the CE# TTL buffer formed by M4-—M6. These 
circuits were always enabled in first-generation Intel 
flash architectures. Turn-on delays of these circuits de- 
termine RP# access time and write specifications. 


LOW POWER 
DETECT 
REDUNDANCY 


CHIP INTERNAL 
RESET 


TO THE REST 
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Figure 10. Power-Down and Reset Functions 
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RP# functions properly with TTL-level inputs. How- 
ever, to attain lowest possible power consumption, full 
CMOS levels must be used. If the voltage on the gate of 
M3 rises above its 0.9V threshold, M3 will turn on and 
draw current. Input voltages in the 0.7V—0.9V range 
could cause enough current conduction in M3 to ex- 
ceed the Icc deep-power-down current (Iccp) specifi- 
cation. This is why RP #’s input voltage is specified as 
GND +0.2V. 


RP# also functions as a hardware reset to the WSM 
and CUI. If RP# is driven low (‘0’’) during word/byte 
write, block erase, or erase suspend, that operation is 
aborted leaving the addressed memory locations in an 
unknown state. The Status Register is cleared, and CUI 
is set to array read. The aborted operation (word/byte 
write or block erase) must be repeated with RP # inac- 
tive to obtain a valid condition in the memory array. 


RP# reset should be restricted to system reset only (as 
in the case of power supply failure), and should not be 
used as a standard means to terminate word/byte-write 
or block-erase operations. NOTE: Use the erase-sus- 
pend command to read another block (see the “Erase 
Suspend/Resume”’ section). 


This use of RP # during system reset is important with 
automated write/erase devices. When the system comes 
out of reset it expects to read from the flash memory. 
Automated flash memories provide status information 
when accessed during write/erase modes. If a CPU re- 
set occurs with no flash memory reset, proper CPU 
initialization would not occur because the flash memo- 
ry would be providing the status information instead of 
array data. Intel’s Flash Memories allow proper CPU 
initialization following a system reset through the use 
of the RP# input. 


intel. 
Automatic Power Savings 


The 2/4-Mbit boot block flash memories include an 
automatic power-savings feature that reduces Icc dur- 
ing read mode. Within one access time (tacc or tcR) 
after an address or CE# switches, Icc automatically 
powers down from the 60 mA Ic¢c CMOS specification 
(or 65 mA TTL specification) to less than 1 mA. Icc 
remains below 1 mA until either CE# or an address is 
switched, or until the device is taken out of read mode. 
This feature provides significant power savings for ap- 
plications that access the device slower than their speci- 
fied read access times. 


Block Erase 


Block erasure is achieved by a two-step write sequence. 
The erase-setup code is written to the CUI in the first 
cycle. Erase confirm is written in the second cycle. The 
address supplied with the erase-confirm command is 
latched and decoded internally by the device; erase is 
subsequently enabled in that block. The second -‘WE# 
rising edge initiates the operation (WE#-controlled 
write). 


The WSM triggers the high-voltage flash-erase switch 
connecting the 12V supply to the source of all bits in 
the specified block, while all wordlines are grounded. 
Figure 12 shows organization of the block source 
switches. Fowler-Nordheim tunneling results in simul- 
taneous erasure of all bits in the selected block. 


The block source switch (shown in Figure 11) controls 
the source voltage of all bits in a particular block. Dur- 
ing block erase, M2 is off and M1 pulls the source to 
Vpp. When not in erase, M1 is off and M2 pulls the 
source to ground. The high-voltage latch formed by 
M4-M7 converts the low-voltage ERASE signal to a 
high-voltage signal that controls M1. 


BLOCK 


SOURCE 
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Figure 11. Block Source Switch 
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Figure 12. Array Erase Blocking 


The tunneling that occurs during block erase requires 
only a small amount of current. However, the initial 
current required to charge the block’s cumulative 
source capacitance to the erase voltage is large. Supply 
decoupling design practices minimize the system im- 
pact of the source charging. 


The LOWV cc signal protects the array from erasure 
when Vpp is at a high voltage, but Vcc is below the 
write/erase lockout voltage (VL Ko). When this occurs, 
M3 pulls the block source to ground. The high-voltage 
latch is forced by M8 into the state that turns MI off. 


Vpp is continually monitored during all phases of the 
block-erase operation. If Vpp falls below the trip point 
of its high-voltage detect circuitry, erasure will not oc- 
cur (or halts) and Status Register Vpp status (SR.3), 
block-erase status (SR.5) and WSM status (SR.7) bits 
are set to “1”. 


If SR.3 is set (Low Vpp), WSM operation is inhibited. 
The WSM will not execute further word/byte-write or 
block-erasure sequences until the Status Register has 
been reset by system software. Word/byte-write or 
block-erase requests with error flags SR.4 or SR.5 set 


are not inhibited, but the system loses the ability to — 


determine success. The clear Status-Register command 
resets these bits. 


After receiving the block-erase command sequence, the 
WSM automatically controls block pre-condition (pro- 
gramming all words to OOOOH within the chosen block), 
erase pulses and pulse repetition, timeout delays, and 
word-by-word verification of all block addresses (se- 
quentially checked via the address counter) using an 
alternative sensing reference to verify margin. The in- 
ternal erase and verify operations continue until the en- 
tire block is erased. A read cycle applied to the part 
following the block-erase command sequence outputs 
Status Register contents; system software can poll the 
Status Register to determine when block erase has suc- 
cessfully completed. Following block erasure, the de- 
vice remains in Status Register read block erasure, the 
device remains in Status Register read mode; a read-ar- 
ray command must be written to the device to access 
array data. 


If the erase-setup command is followed with a com- 
mand other than erase confirm, the device will not 
erase. The WSM sets both word/byte-write status and 
block-erase status bits in the Status Register to indicate 
an invalid sequence. 
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Erase Suspend/Resume 


Erase suspend allows the system to interrupt block 
erase to read data from another array block. The ability 
to suspend erase and read data from another block of- 
fers the flexibility required for embedded applications. 
Upon receiving the erase-suspend command. the CUI 
requests that the WSM pause at one of several predeter- 
mined points in the algorithm. Upon reaching a sus- 
pend point, the WSM sets SR.6 (erase-suspend status) 
and SR.7 to “1”. The system must poll the Status Reg- 
ister to determine if the suspend has been processed or 
the block erase has actually completed. Block-erase 
completion is indicated by SR.6 cleared to “0” and 
SR.7 set to “1”. Read bus cycles default to Status Reg- 
ister read after issuing the erase-suspend command. 


Once suspended, the WSM asserts a signal to the CUI 
which allows response to: the read-array, read-status, 
and erase-resume commands. The system can write the 
read-array command allowing read access to blocks 
other than that which is suspended. The WSM contin- 
ues to run, idling in a suspended state, regardless of all 
control inputs except RP#. RP# driven low immedi- 
ately shuts down the WSM, aborting the suspended 
erase operation. 


The erase-resume command must be issued upon com- 
pletion of reads from other array blocks to continue 
block-erase operation. The WSM then clears SR.6 and 
SR.7, and resumes erase operation from the suspension 
point. Read cycles following the erase-resume com- 
mand output Status Register data. 


Word/Byte Write 


Word/byte write follows a flow similar to block erase. 
The word/byte-write-setup command is first written to 
the CUI. A second write cycle loads address and data 
latches. The rising edge of the second WE# pulse re- 
quests that the WSM initiate activity, applying high 
voltage to the gates and drains of all bits to be written. 
Unlike block erase, word/byte write will proceed re- 
gardless of what data is applied on the second CUI 
write cycle; however writing data FFFFH (or FFH) 
does not modify memory contents. 


Like block erase, the WSM controls program pulses 
and pulse repetition, timeout delays and word/byte ver- 
ification. Word/byte write and verify (with alternate 
sensing reference and internally-generated verify volt- 
age) continue until the word/byte is written. Internal 
word/byte-write verify checks that all bits written to 
zero have been correctly modified; it does not check 
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bits specified as one. Word/byte write cannot change 
existing zeros to ones; this can only be accomplished by 
erase. 


Read bus cycles following word/byte-write operations 
output Status Register data. System software, polling 
the Status Register, is informed of status through bits 
SR.3, SR.4, and SR.7. The read-array command must 
be written to the CUI following word/byte write to 
access array data. 


In a scenario similar to that described under block era- 
sure, word/byte write does not occur (or halts) if Vpp is 
detected low. In such a case SR.3, SR.4, and SR.7 are 
set high, and no further writes can take place until the 
Status Register is cleared by the Clear Status Register 
command. 


DEVICE CHARACTERIZATION 


AC and DC Parameters 


Figures 14 through 35 show graphs of several device 
parameters as a function of temperature and supply 
voltage. 


In particular, note Figure 14 which shows typical read 
performance tavov (tacc) of the 28F400BX, which is 
representative of the 2/4-MBit boot block flash memo- 
ry family, as a function of Vcc and ambient tempera- 


ture. tptgv (tcg) in Figure 15 and tgrav (tog) in 
Figure 16 are also of particular interest. Access times 


tavov; teELgv: and tgiov are specified and tested with 
an output load of 100 pF; decreased output load capaci- 
tance improves device operation. 


Table 1 shows typical supply currents for several oper- 
ating modes. 


Table 1. RMS Current Values 


Icc 
(Vcc = 5.0V, Ipp 
CMOS Inputs) |(Vpp = 12V) 


ras] 
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Energy/Power Consumption DEVICE RELIABILITY 


The system designer may be concerned with power con- 
sumption during block erase and word/byte write. Fig- Word/Byte-Write and Block-Erase 
ure 32 shows Icc and Ipp during block erase. Figure 33 Cycling 
shows Icc and Ipp during word/byte write. 
One of the most important reliability aspects of the 
2/4-Mbit boot block family is its capability of 100,000 
Word/ Byte-Write and Block-Erase write/erase cycles per block. Destructive oxide break- 
Times down has been a limiting factor in extended cycling of 
thin-oxide EEPROMs. Intel’s ETOX Flash Memory 
The 2/4-Mbit boot block family and 28FOO8SA ad- technology extends cycling performance through: 
vance word/byte-write and block-erase performance e Improved tunnel-oxide processing that increases 
compared to previous flash memories. The on-chip al- charge-carrying capability tenfold. 
gorithm is improved over the 28F001BX to take advan- 
tage of. process enhancements. This improvement is 
most apparent when compared to first-generation flash 


e Significantly reduced oxide area under stress that 
- minimizes probability of oxide defects in the region. 


memory parts with externally controlled algorithms. © Reduced oxide stress due to a lower peak electric 
First-generation device times shown in Table 2 assume field (lower erase voltage than EEPROM). 

optimal system overhead, and as such are absolute best 

case. 


Table 2. Word/Byte-Write and Block-Erase 
Performance vs Previous Devices 


Word/Byte- Block-Erase Erase Time 
Write Time | Time/# Bytes per Kbyte 


SECOND-GENERATION FLASH MEMORY DEVICES(1) 


28F400BX 2.4s/128KB 
28F004BX 2.2s/96KB 
28F200BX 1.0s/16KB 
28F002BX 1.0s/8KB 


3.8s/112KB 
2.1s/8KB 
2.1s/4KB 


28F256A 16.5 ps 


NOTES: 

1. Typical measured time. 

2. Times calculated based on typical erase and precondition pulse requirements, 
with minimum write timings. Calculations are described in Figure 13. 
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Reliable word/byte-write and block-erase cycling re- 
quires proper selection of the maximum erase threshold 
voltage (V;), and maintenance of a tight distribution. 
Maximum erase V; is set to 3.4V via the internal block- 
erase algorithm and verify circuits. Tight erase V; dis- 
tribution gives an order of magnitude of erase-time 
margin to the fastest erasing cell, with virtually identi- 
cal erase V; distributions at 1 and 10,000 cycles (Figure 
34). Program V; distribution is similarly consistent over 
cycling (Figure 35). 


Data Protection 


The 2/4-Mbit boot block family offers protection 
against accidental block erasure or word/byte write 
during power transitions. Internal circuitry creates a 
device insensitive to Vpp/Vcc supply power-up/down 
sequencing. 


Vpp < Vpp_~MAx locks out word/byte-write and 
block-erase circuits. Voc < ViLKo disables CUI com- 
mand writes, resets the CUI to array-read mode, and 
holds the WSM inactive. The system designer must still 
guard against spurious command writes for Voc > 


VLKo when Vpp < VpplrMAx: 


Several strategies are available to prevent data modifi- 
cation in the 2/4-Mbit family. The CUI provides a de- 
gree of software write protection since memory altera- 
tion occurs only after successful completion of a two- 
step write sequence. WE# and CE# must both go ac- 
tive to perform this sequence; driving either high inhib- 
its command/data writes. Secondly, the system can 
place the device in deep-power-down mode (RP# = 
VL) to disable command writes, reset the CUI to ar- 
ray-read mode, and hold the WSM inactive, effectively 
protecting array data and providing a way to reset the 
flash memory during system reset conditions. Finally, 
the system designer may switch Vpp to Vppy when 
memory updates are required. , 
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SUMMARY 


Intel’s 2/4-Mbit boot block Flash Memory family con- 
tains features that optimize this product group for com- 
puting and embedded applications. These features in- 
clude hardware-implemented write/erase protection of 
the boot block, specialized array blocking, dedicated 
x8 and x8/16 user-configurable versions, automation 
of word/byte write and block erase, erase suspend for 
data read, deep-power-down/automatic-power-savings 
modes, reset capability, and a write/erase Status Regis- 
ter. With simple microprocessor interfacing and soft- 
ware command sequences, this family is the non-vola- 
tile computing and embedded solution of choice for to- 
day’s designs. | 


OTHER REFERENCES 


Related documents of interest to readers of this engi- 
neering report: 


28F400BX-T/B, 28FO04BX-T/B; “4-Mbit Flash Mem- 
ory Family” Data Sheet (Order #290450) 


28F400BX-TL/BL, 28FOO4BX-TL/BL; “‘4-Mbit Flash 
Memory Family’ Data Sheet (Order #290451) 


28F200BX-T/B, 28FO02BX-T/B; “‘2-Mbit Flash Mem- 
ory Family” Data Sheet (Order #290448) 


28F200BX-TL/BL, 28FO02BX-TL/BL,; “‘2-Mbit Flash 
Memory Family” Data Sheet (Order #290449) 


ER-28 “ETOX III Flash Memory Technology” Engi- 
neering Report (Order #294012) 


AP-341 “Designing an Updatable BIOS Using Flash 
Memory” (Order #292077) 


AP-363 “Extended Flash BIOS for Portable Comput- 
ers” (Order #292098) 
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® 
SUPPLEMENTARY INFORMATION 
FORMULA: 
b=  # bytes in a block (256K, 128K, 64K, 32K) 


n=  # of erase pulses required (90 pulses) 
w = Time for a write cycle (150 ns, tayay) 


v = Time to verify (6055 ns, twHGL + tGLev) 


p = Program pulse width (10 ps, twHwuH1) 
one pulse programming assumed 


e = Erase pulse width (10 ms, twywuH?) 


= 
”n 
c 
w 
oO 
oO 
a 


_ Precondition and precondition verify time is: 
b (2w + p + v) 


Erase/verify, each loop where some byte 
does not pass verify: 
in = 1) (2w +6 + v) 


‘ 4.0 4.2 4.4 4.6 4.8 5.0 5.2 5.4 5.6 5.8 6.0 
ast erase pulse: 
Pp Voc (V) 


(1) (2w + e) 
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Passing erase-verify, all bytes: 


hig a Figure 14. tayqy (tacc) 


vs Vcc and Temperature 


Total time can be summarized as: 
b (83w + p + 2v) + n(2w + e + v) — (Vv) 


or substituting in times for write, verify, 
program and erase pulse widths: 
b (22.56 x 10-8) + n(10.006355 x 10-3) — 
(6.055 x 10-8) Seconds 


Figure 13. Erase Time Calculations for 
First-Generation Fiash Memories 
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Figure 15. te_aqvy (tce) Figure 16. teLav (toe) 
vs Vcc and Temperature vs Vcc and Temperature 
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Figure 17. topywu (tps WE #) 
vs Vcc and Temperature 
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Figure 19. taywu (tas WE #) 
vs Vcc and Temperature 
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Figure 18. twHpx (tpy WE #) 
vs Vcc and Temperature 
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Figure 20. twHax (tan WE #) 
vs Vcc and Temperature 
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Figure 21. toven (tps CE #) 
vs Vcc and Temperature 
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Figure 23. taven (tas CE #) 
vs Vcc and Temperature 
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Figure 22. teypx (tpH CE #) 
vs Vcc and Temperature 
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Figure 24. tenax (tan CE#) 
vs Vcc and Temperature 
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Figure 25. twLwu (twp) 
vs Vcc and Temperature 
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Figure 27. lo. vS Vcc and Temperature 
(VoL = 0.45V) 
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Figure 26. Iloy TTL 
vs Vcc and Temperature 
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Figure 28. lo CMOS vs Vcc and Temperature 
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Figure 29. icc (RMS) vs Frequency Figure 30. icc (RMS) vs Frequency 
x16 Operation x8 Operation 
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Figure 31. Access Time vs Output Loading 
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Figure 32. Ilcc and Ipp during Block-Erase Operation 
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Figure 33. Ilcc and Ipp during Word-Write Operation 
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Figure 34. Typical Process Data for Erase V; vs Cycles 


Programmed V; Dist. vs Cycling; Vpp = 12V; Ta = Room 
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Figure 35. Typical Process Data for Program V; vs Cycles 
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Figure 36. 28F400BX/28F004BX Die Photograph 
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Pin Names 


Address Inputs 
Data Inputs/Outputs | 
CE# Chip Enable 


Write Enable 


1 3 
28F400BX 
2 33 


BYTE# 
GND 
DQ 45/A_4 
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Figure 37. PSOP Lead Configuration 
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28F200BX 
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28F400BX 
56-LEAD TSOP 
14mm x 20mm 

TOP VIEW 
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28F002BX 28F002BX 
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28FO004BX 
40-LEAD TSOP 
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TOP VIEW 
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Figure 38. TSOP Lead Configuration 
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Addresses Ag—Ap sequentially decode wordlines. Wordlines 0— 1023 serve the upper and lower array planes. 
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Table 3. Row Address Bitmap 


~ 
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Columns for each block are distributed throughout the array in each I/O. For the 28F400BX/200BX, each I/O 
contains 8 columns for the boot block, 4 columns each for parameter block 0 and parameter block 1, 48 columns for 
main block 0 and 64 columns for each of the remaining main blocks (main block 1 for the 23F200BX and main block 
1—3 for the 28F400BX) for a total of 256 columns (28F400BX) or 128 columns (28F200BX) per output. 


Table 4. 28F400BX/200BX Column Decodin ' 


esd 
a | 


NOTE: 28F400BX = Complete Table, 28F200BX = Shaded Area Only 
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Columns for each block are distributed throughout the array in each I/O. For the 28F004BX/002BX, each I/O 
contains 16 columns for the boot block, 8 columns each for parameter block 0 and parameter block 1, 96 columns for 
main block 0 and 128 columns for each of the remaining main blocks (main block 1 for the 28FO02BX) and main 
block 1-3 for the 28FO04BX for a total of 512 columns (28F0O04BX) or 256 columns (28FO02BX) per output. 


Table 5. 28F004BX/002BX Column Decoding 


ws 


seas 


NOTE: 28FO004BX = Complete Table, 28F002BX = Shaded Area Only 
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BOOT BLOCK FLASH: 
THE NEXT GENERATION 


INTRODUCTION 


Flash memory offers a whole new dimension to nonvol- 
atile memory applications because of its high density 
and cost-effectiveness. Embedded systems, such as PC 
BIOS, hard disk drive controllers and laser printers, 
were among the first applications to utilize the easy 
update capability of Flash, allowing system differentia- 
tion and upgradeability. In 1992, Intel introduced a se- 
ries of high-density Flash Memory Cards based on its 
8-Mbit FlashFileTM component, products that are en- 
abling truly portable computing capability with disk- 
less, solid-state mass storage. Intel also added two flash 
memory products designed specifically to serve more 
traditional embedded and portable applications, offer- 
ing both high performance and low power consumption 
options in an architecture specifically designed for these 
applications storage requirements. 


MARKET GROWTH DATA 


In the four years since Intel first introduced its 
256-Kbit flash devices, the worldwide demand has 
quadrupled annually, with 1992 market demand fore- 
casted to exceed $270 million. Flash is expected to con- 
tinue double-digit growth through the upcoming years 
while other memory technologies are relatively flat or 
increasing only slightly. By 1994, the flash market is 
expected to exceed $1 billion (Figure 1). The primary 
reasons for this growth are well acknowledged by cus- 
tomers: flexibility, nonvolatility, low power and cost-ef- 
fectiveness. As a result of this seemingly insatiable de- 
mand for flash, the memory density treadmill that al- 
lowed DRAMs and EPROMs to double every 18 
months, has accelerated faster than ever before. Intel’s 
introduction of an 8-Mbit component two years after its 
2-Mbit product is evidence of the flash memory’s rapid 
advancement. 


Intel’s first generation of flash devices, ranging in densi- 
ty from 256-Kbit through 2-Mbit densities, were rapid- 
ly adopted into code storage applications which former- 
ly used EPROM or EEPROM. In 1991, Intel intro- 
duced the first 1-Mbit Boot Block flash memory in re- 
sponse to direct customer requests. As a result of con- 
tinuing to improve and develop an innovative and 
broad product line, Intel held an 85% share of the $130 
million 1991 market. 


November 1992 
Order Number: 297137-001 


297137-1 


Source Dataquest: January 1992 


Figure 1 


INTEL SERVING TWO PRIMARY 
APPLICATIONS 


Today, Intel flash is serving two major application seg- 
ments: updatable code storage and solid-state mass 
storage (Figure 2). Code and data storage comprise the 
updatable non-volatile memory applications that re- 
quire high performance, high density and easy update 
capability. These applications are infrequently. updated 
when compared to solid-state mass storage applica- 
tions. In this case, erase/write performance is not as 
critical as integration and performance requirements. 
This application segment is served effectively with full 
chip-erase or boot block products. 


The second major application segment is solid-state 
mass storage that requires very high density, automated 
programming and high performance erase/write capa- 
bility at a very low cost per bit. Erasing and writing 
portions of the code or data is much more frequent in 
solid-state mass storage than in updatable firmware ap- 
plications. In April of 1992, Intel introduced the 
8-Mbit FlashFile component whose architecture is opti- 
mized for data file storage. Its symmetrically blocked 
architecture and automated write/erase features gave 
programming flexibility for a high-performance, solid- 
state memory system. The compactness of an 8-Mbit 
device in a TSOP package allows for high-density flash 
arrays to be included on a system motherboard as well 
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Figure 2 


as in memory cards. Intel also offers a second genera- 
tion of flash memory cards designed to serve the porta- 
ble mass storage market that are based on the new 
8-Mbit FlashFile component. Memory cards add the 
feature of removability and system upgradability in an 
industry-standard PCMCIA/ExCA™ format. While 
flash cards and FlashFile components serve solid-state 
mass storage applications directly, both can be used in 
updatable code storage applications as well. 


By developing products to fit both of these application 
segments, Intel strives to serve the needs of a broader 
base of customer applications with the best nonvolatile 
memory ‘solutions. 


BOOT BLOCK UPDATE 


The 28F001BX 1-Mbit Boot Block flash component in- 
troduced in June 1991 featured a sectored architecture 
that has been widely accepted in embedded code stor- 
age applications, particularly PC BIOS and cellular 
communications. Over 20 PC manufacturers use this 
device in their products, including Compaq, Dell and 
Zenith Data Systems. The Boot Block architecture gave 
the manufacturer added flexibility and the ability to 
differentiate. End users also benefit from the ability to 
upgrade BIOS software quickly and securely. It is pos- 
sible for the manufacturer to upload BIOS updates to 
an electronic bulletin board where the end-user gets the 
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upgrade for the price of the call. The blocked architec- 
ture allows the OEM customer to store critical system 
code securely in the boot block of the device that can 
minimally bring up the system and download to other 
locations of the device to initialize the system. The 
hardware boot locking feature guarantees that even if 
the power is disrupted during a BIOS update, the sys- 
tem will be able to recover immediately. 


The success of the 1-Mbit Boot Block device has result- 
ed in over 150 designs with annual shipments to exceed 
1.5 million units worldwide in 1992. 


EXTENDING THE BOOT BLOCK 
PRODUCT LINE: 2- AND 4-MEGABIT 
FLASH DEVICES 


Once the Boot Block architecture became established in 
the marketplace, customers quickly began to ask for 
more features and enhancements: speed, density, low 
power, surface-mount options and an industry-standard 
upgrade path. These requests were based on the need to 
expand features in portable computing and communi- 
cation products. 


The 2-Mbit 28F200BX and 4-Mbit 28F400BX are In- 
tel’s newest additions to the flash Boot Block product 
line. These products offer 60 ns performance, two sur- 
face-mount packages, and a Boot Block architecture 


intel. 

similar to the 1-Mbit Boot Block device: one lockable 
Boot Block, two parameter blocks, and the balance of 
the device is divided into main blocks. The Boot Block 
securely stores the basic boot code required to initialize 
the system that can be protected by the hardware-lock- 
ing feature, ensuring basic system operating code pro- 
tection. The two parameter blocks can be used for a 
variety of purposes: manufacturing product code, setup 
parameters and storing frequently updated data such as 
system diagnostics. The 28F200BX contains one 
16 Kbyte Boot Block, two 8 Kbyte parameter blocks, 
one 96 Kbyte and one 128 Kbyte main block (Figure 
3a). The 28F400BX contains all of the blocks of the 
28F200BX plus two additional 128 Kbyte main blocks 
(Figure 3b). Top and bottom Boot Block versions are 
available for both densities. Both devices are in the 
x16/x8 user-selectable organization of the industry- 
standard, ROM-compatible pin-out in 44-lead PSOP 
surface mount package. This pinout and package allow 
an easy upgrade from 2-Mbit to 4-Mbit since only one 
address is added at the top of the device package. For- 
ty-lead TSOP x8-only versions are also available for 
both of these devices, providing high density in the 
smallest form factor. A 56-lead TSOP x16/x8 version 
will be available for applications requiring x16 organi- 
zation in a TSOP package. 


16 Kbyte BOOT BLOCK 


8 Kbyte PARAMETER BLOCK 


1FFFFH 


1E000H 
1DFFFH 


1D000H 
1CFFFH 


1C000H 
1BFFFH 


8 Kbyte PARAMETER BLOCK 


96 Kbyte MAIN BLOCK 


10000H 
OFFFFH 


128 Kbyte MAIN BLOCK 


Figure 3a. 28F200BX-Top Boot 
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APPLICATION REQUIREMENTS—PCs 


Notebook computer manufacturers today are compet- 
ing to produce the lightest weight, slimmest and longest 
battery life products possible. Minimizing board size 
via reduced chip count is the first improvement the new 
flash devices provide. BIOS in portable systems has 
grown beyond the 1-Mbit density to accommodate 
more sophisticated power management and additional 
system features, such as PCMCIA card slots. For ex- 
ample, the i386™ SL architecture allows the expansion 
of BIOS beyond 128 Kbytes (1-Mbit) with internal reg- 
isters for hardware paging. A new generation of BIOS 
support for low-power portable computers has been de- 
veloped by SystemSoft and other vendors which sup- 
ports the 28F200BX and the 28F400BX. In PC BIOS 
applications, the main blocks of the Boot Block devices 
are used for power management code, video drivers, 
and ROM-executable code, such as MS-DOS". The ar- 
rangement of the blocks for PC BIOS applications 
based on Intel i386 and i486™ microprocessors is with 
the Boot Block on top. Other microprocessors and mi- 
crocontrollers, such as the Intel 80960K X/SX and the 
Motorola 68000 series, use the bottom Boot Block ver- 
sion of the memory map. Many PC manufacturers have 
also moved to a x16 organization of their BIOS for 


16 Kbyte BOOT BLOCK 


8 Kbyte PARAMETER BLOCK 


3FFFFH 


3E000H 
3DFFFH 


3D000H 
3CFFFH 


3C000H 
3BFFFH 


8 Kbyte PARAMETER BLOCK 


96 Kbyte MAIN BLOCK 


30000H 
2FFFFH 


128 Kbyte MAIN BLOCK 


20000H 
1FFFFH 


128 Kbyte MAIN BLOCK 


10000H 
OFFFFH 


128 Kbyte MAIN BLOCK 


00000H 


Figure 3b. 28F400BX-Top Boot 
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higher performance and are using 2-Mbit flash compo- 
nents in parallel to accomplish x16 performance. Other 
manufacturers have decided to forego x16 and use the 
1-Mbit Boot Block and a 1-Mbit bulk-erase 28F010 
flash memory to contain their power management code. 
The 28F200BX solves both of these problems in a com- 
pact, single-chip solution. The 28F400BX provides a 
higher density solution for high performance systems 
today, as well as a future upgrade for systems currently 
requiring only 2 megabits. 


APPLICATION REQUIREMENTS— 
TELECOMMUNICATIONS/EMBEDDED 


Similar to personal computers, cellular telephone appli- 
cations use the hardware-lockable block to store basic 
initialization code to wake up the system and establish 
basic communication with the host base station. The 
small parameter blocks are ideal for frequently updated 
code such as the user’s phone directory, re-dial and the 
activation code necessary to enable user-desired fea- 
tures. The main block contains the code for dynamical- 
ly managing the cellular communications and executing 
the voice algorithms. The density requirement for the 
main code storage has increased significantly in recent 
years with the conversion to digital cellular transmis- 
sion, particularly in Europe and Japan. Most cellular 
designs execute code directly from ROM rather than 
downloading to RAM. Typical microcontrollers used 
are: Intel 80C186, Zilog Z8080 and Siemens 80166, all 
operating in the 8 MHz-—13 MHz range. The Motorola 
68000 series 16-bit microcontrollers used in some digi- 
tal cellular designs utilize the x16 and high speed capa- 
bilities of these new Boot Block devices. Flash access 
times ranging from 75 ns to 120 ns produce 0 to 1 wait- 
state performance. The high-performance 60 ns access 
time of the 2-Mbit and 4-Mbit Boot Block flash allows 
zero wait state performance in cellular telephones and 
other embedded control applications. 


Low power has always been a strength of flash due to 
its inherent nonvolatility, a characteristic that elimi- 
nates battery drain required to maintain information 
stored in volatile RAM when the power is off. When 
flash is in use, its active power requirement is very low: 
typical Ic¢¢c = 35 mA, and standby current is 0.1 mA. 
The hallmark of this newest generation of flash is low 
power and high performance. Formerly these features 
were mutually exclusive, but through advanced circuit 
development, an automated power saving feature in the 
device reduces Icc to a low DC level within one access 
time; 5 mA typical. This significant reduction of the 
active current time relates directly to the extension of 
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battery life in systems which continuously execute code 


directly from flash, such as cellular telephones and por- 
table instrumentation. 


For optimum system power conservation, future sys- 
tems are being designed today to operate at 3.3V rather 
than 5V. Intel will also offer 3.3V versions of the 
2-Mbit and 4-Mbit Boot Block devices with Icc active 
= 10 mA, and tacc performance = 150 ns. 


An alternative design approach of a “5V-only” (pro- 
gramming voltage = operating voltage = 5V) flash 
memory has been proposed to eliminate the need for a 
12V programming supply. While this proposal would 
eliminate the need for a 12V supply component in a 5V- 
only environment, it would not provide a low power 
solution as every flash component would carry the die 
size cost and power overhead of on-chip voltage pump- 
ing. Intel’s approach is to first bring the operating volt- 
age to 3.3V, in line with what system designers request- 
ed as their first priority for the next generation of porta- 
ble computers and cellular phones. The focus of lower- 
ing the read voltage is also congruent with the usage 
model for embedded applications of “read often, write 
few” operation. The 12V programming voltage require- 
ment is more efficiently met with a voltage pump from 
a vendor such as Maxim. (Inexpensive voltage pumps 
for 3.3V to 12V are currently available.) The use of a 
separate voltage pump is significantly more cost-effi- 
cient in systems where more than one flash device is 
used, as cost and space is amortized over multiple de- 
vices. 


CONCLUSION 


Intel continues to serve both updatable non-volatile 
memory applications as well as the rapidly emerging 
solid-state mass storage market with solutions tailored 
to meet their particular needs. The new 2-Mbit and 
4-Mbit Boot Block devices offer high performance and 
low power options for updatable code applications. The 
Boot Block architecture is compatible with all major 
microprocessors and microcontrollers. As with all Intel 
flash products, their low power consumption and small 
surface mount packaging make the 2-Mbit and 4-Mbit 
Boot Block flash memories ideal for a wide variety of 
handheld portable applications. 


NOTE: 
FlashFile, ExCA, i386 and i486 SL are trademarks of 
Intel Corporation. 


*MS-DOS is a registered trademark of Microsoft Corpora- 
tion. 


Intel 2/4Mbit Boot Block 
Flash Memory Evaluation Module 
(D,FLASHEVALS) Product Brief 


Kit @ 28F200BX/28F002BX 

Contents 28F400BX/28F004BX 
Adapter Board with: 

w@ 40-ld TSOP Socket 

mw 56-ld TSOP Socket 

@ 44-ld PSOP Socket 


@ 5.25" Floppy Disk with iFlash2 
Software (Version 2.4) 


@ Technical Documentation 
Describing Intel's 28F200BX/ 
28F002BX and 28F400BX/ 
28F004BX Flash Memory 
devices 


@ Flash Memory Evaluation Kit II 
Installation Guide and User's 


Manual with 28F200BX/ oe _. 
28F002BX/28F400BX/28FO04BX 70)" s 28F200BX/28F002BX/28F 400BX/28F004BX Boot Block Flash 
Adapter Board Installation Memory Evaluation Module provides system designers with a cost-effective 
Instructions prototyping tool for writing and erasing this flash memory device. This 
ee evaluation module is a hardware adapter board upgrade to the Intel Flash 
@ Registration Card Memory Evaluation Kit II (D, FLASHEVAL2) which supports the 2 and 4 


megabit boot block flash memories in 40-lead TSOP, 56-lead TSOP, and 
44-lead PSOP packages. 


Kit Description 


The 28F200BX/28F002B X/28F400BX/28F004BX Evaluation Module, used with 
Intel's Flash Memory Evaluation Kit, provides the hardware, software and system 
interface necessary to evaluate and integrate Intel's 2 and 4Mbit Boot Block Flash 
Memories into your next design. 


The module provides instructions to install the 28F200BX/28F002B X/28F400BX/ 
28F004BX adapter board. Technical documentation includes 28F200BX/ 
28F002B X/28F400B X/28F004BX datasheets, engineering reports and application 
notes. Together, they provide a complete description of the technology and 
important design considerations. 
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28F020 


2048K (256K x 8) CMOS FLASH MEMORY 
m@ Flash Electrical Chip-Erase m= Command Register Architecture for 
— 2 Second Typical Chip-Erase Microprocessor/Microcontroller 
m Quick-Pulse Programming Algorithm Compatible Write Interface 
— 10 us Typical Byte-Program m@ Noise Immunity Features 
— 4 Second Chip-Program — +10% Vcc Tolerance 


— Maximum Latch-Up Immunity 
through EPI Processing 


m ETOX Nonvolatile Flash Technology 


m@ 100,000 Erase/Program Cycles 
m 12.0V +5% Vpp 


m High-Performance Read — EPROM-Compatible Process Base 
— 70 ns Maximum Access Time — High-Volume Manufacturing 
m CMOS Low Power Consumption Experience 
— 10 mA Typical Active Current m JEDEC-Standard Pinouts 
— 50 vA Typical Standby Current — 32-Pin Plastic Dip 
— 0 Watts Data Retention Power — 32-Lead PLCC 
m Integrated Program/Erase Stop Timer — 32-Lead TSOP 


(See Packaging Spec., Order #231369) 
m Extended Temperature Options 


Intel’s 28FO020 CMOS flash memory offers the most cost-effective and reliable alternative for read/write 
random access nonvolatile memory. The 28F020 adds electrical chip-erasure and reprogramming to familiar 
EPROM technology. Memory contents can be rewritten: in a test socket; in a PROM-programmer socket; on- 
board during subassembly test; in-system during final test; and in-system after-sale. The 28F020 increases 
memory flexibility, while contributing to time-and cost-savings. 


The 28F020 is a 2048-kilobit nonvolatile memory organized as 262,144 bytes of 8 bits. Intel’s 28F020 is 
offered in 32-pin plastic DIP, 32-lead PLCC, and 32-lead TSOP packages. Pin assignments conform to JEDEC 
standards for byte-wide EPROMs. 


Extended erase and program cycling capability is designed into Intel’s ETOX (EPROM Tunnel Oxide) process 
technology. Advanced oxide processing, an optimized tunneling structure, and lower electric field combine to 
extend reliable cycling beyond that of traditional EEPROMs. With the 12.0V Vpp supply, the 28F020 performs 
100,000 erase and program cycles well within the time limits of the Quick-Pulse Programming and Quick-Erase 
algorithms. 


Intel’s 28FO020 employs advanced CMOS circuitry for systems requiring high-performance access speeds, low 
power consumption, and immunity to noise. Its 70 nanosecond access time provides no-WAIT-state perform- 
ance for a wide range of microprocessors and microcontrollers. Maximum standby current of 100 pA trans- 
lates into power savings when the device is deselected. Finally, the highest degree of latch-up protection is 
achieved through Intel’s unique EPI processing. Prevention of latch-up is provided for stresses up to 100 mA 
on address and data pins, from —1V to Vcc + 1V. 


With Intel’s ETOX process base, the 28F020 levers years of EPROM experience to yield the highest levels of 
quality, reliability, and cost-effectiveness. 
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Figure 1. 28F020 Block Diagram 


Table 1. Pin Description 


Name and Function 


DATA INPUT/OUTPUT: Inputs data during memory write cycles; 
outputs data during memory read cycles. The data pins are active high 
and float to tri-state OFF when the chip is deselected or the outputs 

are disabled. Data is internally latched during a write cycle. 


CHIP ENABLE: Activates the device’s control logic, input buffers, 
decoders and sense amplifiers. CE # is active low; CE # high 
deselects the memory device and reduces power consumption to 
standby levels. 


OE # INPUT OUTPUT ENABLE: Gates the devices output through the data buffers 
during a read cycle. OE # is active low. 


WE # WRITE ENABLE: Controls writes to the control register and the array. 
Write enable is active low. Addresses are latched on the falling edge 
and data is latched on the rising edge of the WE # pulse. 
Note: With Vpp < 6.5V, memory contents cannot be altered. 


ERASE/PROGRAM POWER SUPPLY for writing the command 
register, erasing the entire array, or programming bytes in the array. 


/Vcc === | s*s*éi‘(tss DEVICE POWER SUPPLY (5V + 10%) 
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Figure 2. 28F020 Pin Configurations 
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APPLICATIONS 


The 28F020 flash memory provides nonvolatility 
along with the capability to perform over 100,000 
electrical chip-erasure/reprogram cycles. These fea- 
tures make the 28F020 an innovative alternative to 
disk, EEPROM, and battery-backed static RAM. 
- Where periodic updates of code and data-tables are 
required, the 28F020’s reprogrammability and non- 
volatility make it the obvious and ideal replacement 
for EPROM. 


Primary applications and operating systems stored 
in flash eliminate the slow disk-to-DRAM download 
process. This results in dramatic enhancement of 
performance and substantial reduction of power 
consumption — a consideration particularly impor- 
tant in portable equipment. Flash memory increases 
flexibility with electrical chip erasure and in-system 
update capability of operating systems and applica- 
tion code. With updatable code, system manufactur- 
ers can easily accommodate last-minute changes as 
revisions are made. 


In diskless workstations and terminals, network traf- 
fic reduces to a minimum and systems are instant- 
on. Reliability exceeds that of electromechanical 
media. Often in these environments, power interrup- 
tions force extended re-boot periods for all net- 
worked terminals. This mishap is no longer an issue 
if boot code, operating systems, communication pro- 
tocols and primary applications are flash-resident in 
each terminal. 


For embedded systems that rely on dynamic RAM/ 
disk for main system memory or nonvolatile backup 
storage, the 28F020 flash memory offers a solid 
state alternative in a minimal form factor. The 
28F020 provides higher performance, lower power 
consumption, instant-on capability, and allows an 
“execute in place’’ memory hierarchy for code and 
data table reading. Additionally, the flash memory is 
more rugged and reliable in harsh environments 
where extreme temperatures and shock can cause 
disk-based systems to fail. 


The need for code updates pervades all phases of a 
system’s life — from prototyping to system manufac- 
ture to after-sale service. The electrical chip-erasure 
and reprogramming ability of the 28F020 allows in- 
’ Circuit alterability; this eliminates unnecessary han- 
dling and less-reliable socketed connections, while 
adding greater test, manufacture, and update flexi- 


bility. 


& 

intel. 
Material and labor costs associated with code 
changes increases at higher levels of system inte- 
gration — the most costly being code updates after 
sale. Code “bugs”, or the desire to augment system 
functionality, prompt after-sale code updates. Field 
revisions to EPROM-based code requires the re- 
moval of EPROM components or entire boards. With 
the 28F020, code updates are implemented locally 


via an edge-connector, or remotely over a commun- 
cations link. 


For systems currently using a high-density static 
RAM/battery configuration for data accumulation, 
flash memory’s inherent nonvolatility eliminates the 
need for battery backup. The concern for battery 
failure no longer exists, an important consideration 
for portable equipment and medical instruments, 
both requiring continuous performance. In addition, 
flash memory offers a considerable cost advantage 
over static RAM. 


Flash memory’s electrical chip erasure, byte pro- 
grammability and complete nonvolatility fit well with 
data accumulation and recording needs. Electrical 
chip-erasure gives the designer a “blank slate” in 
which to log or record data. Data can be periodically 
off-loaded for analysis and the flash memory erased 
producing a new “blank slate’. 


A high degree of on-chip feature integration simpli- 
fies memory-to-processor interfacing. Figure 4 de- 
picts two 28F020s tied to the 80C186 system bus. 
The 28F020’s architecture minimizes interface cir- 
Cuitry needed for complete in-circuit updates of 
memory contents. ; 


The outstanding feature of the TSOP (Thin Small 
Outline Package) is the 1.2 mm thickness. With stan- 
dard and reverse pin configurations, TSOP reduces 
the number of board layers and overall volume nec- 
essary to layout multiple 28FO20s. TSOP is particu- 
larly suited for portable equipment and applications 
requiring large amounts of flash memory. Figure 3 
illustrates the TSOP Serpentine layout. 


With cost-effective in-system reprogramming, ex- 
tended cycling capability, and true nonvolatility, 
the 28F020 offers advantages to the alternatives: 
EPROMs, EEPROMs, battery backed static RAM, 
or disk. EPROM-compatible read specifications, 
straight-forward interfacing, and in-circuit. alterability 
offers designers unlimited flexibility to meet the high 
standards of today’s designs. 
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Figure 4. 28F020 in a 80C 186 System 


PRINCIPLES OF OPERATION 


Flash-memory augments EPROM functionality with 
in-circuit electrical erasure and reprogramming. The 
28F020 introduces a command register to manage 
this new functionality. The command register allows 
for: 100% TTL-level control inputs; fixed power sup- 
plies during erasure and programming; and maxi- 
mum EPROM compatibility. 


In the absence of high voltage on the Vpp pin, the 
28F020 is a read-only memory. Manipulation of the 
external memory-control pins yields the standard 
EPROM read, standby, output disable, and Intelli- 
gent Identifier operations. 


The same EPROM read, standby, and output disable 
operations are available when high voltage is ap- 
plied to the Vpp pin. In addition, high voltage on Vpp 
enables erasure and programming of the device. All 
functions associated with altering memory con- 
tents—lIntelligent Identifier, erase, erase verify, pro- 
gram, and program verify—are accessed via the 
command register. 


Commands are written to the register using standard 
microprocessor write timings. Register contents 
serve as input to an internal state-machine which 
controls the erase and programming circuitry. Write 
cycles also internally latch addresses and data 
needed for programming or erase operations. With 
the appropriate command written to the register, 
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standard microprocessor read timings output array 
data, access the Intelligent Identifier codes, or out- 
put data for erase and program verification. 


Integrated Stop Timer 


Successive command write cycles define the dura- 
tions of program and erase operations; specifically, 
the program or erase time durations are normally 
terminated by associated program or erase verify 
commands. An integrated stop timer provides simpli- 
fied timing control over these operations; thus elimi- 
nating the need for maximum program/erase timing 
specifications. Programming and erase pulse dura- 
tions are minimums only. When the stop timer termi- 
nates a program or erase operation, the device en- 
ters an inactive state and remains inactive until re- 
ceiving the appropriate verify or reset command. 


Write Protection 


The command register is only active when Vpp is at 
high voltage. Depending upon the application, the 
system designer may choose to make the Vpp pow- 
er supply switchable—available only when memory 
updates are desired. When Vpp = Vpp,, the con- 
tents of the register default to the read command, 
making the 28F020 a read-only memory. In this 
mode, the memory contents cannot be altered. 
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Table 2. 28F020 Bus Operations 


Operation 


READ-ONLY | Standby X 


READ/WRITE 


NOTES: 


L 


1. Refer to DC Characteristics. When Vpp = Vpp, memory contents canbe read but not written or erased. 
2. Manufacturer and device codes may also be accessed via a command register write sequence. Refer to Table 3. All other 


addresses low. 


3. Vip is the Intelligent Identifier high voltage. Refer to DC Characteristics. 
4. Read operations with Vpp = Vppy may access array data or the Intelligent Identifier codes. 
5. With Vpp at high voltage, the standby current equals Icc + Ipp (standby). 


6. Refer to Table 3 for valid Data-In during a write operation. 
7. X can be Viz or Vip. 


Or, the system designer may choose to “hardwire”’ 
Vpp, making the high voltage supply constantly 
available. In this case, all Command Register func- 
tions are inhibited whenever Vcc is below the write 
lockout voltage V; Ko. (See Power Up/Down Protec- 
tion.) The 28F020 is designed to accommodate eéi- 
ther design practice, and to encourage optimization 
of the processor-memory interface. 


The two step program/erase write sequence to the 
Command Register provides additional software 
write protection. 


BUS OPERATIONS 


Read 


The 28F020 has two control functions, both of which 
must be logically active, to obtain data at the out- 
puts. Chip-Enable (CE#) is the power control and 
should be used for device selection. Output-Enable 
(OE#) is the output control and should be used 
to gate data from the output pins, independent of 
device selection. Refer to AC _ read_ timing 
waveforms. 


When Vpp is high (Vppy), the read operation can be 
used to access array data, to output the Intelligent 
Identifier codes, and to access data for program/ 
erase verification. When Vpp is low (Vpp,), the read 
operation can only access the array data. 


Output Disable 


With Output-Enable at a logic-high level (Vj), output 
from the device is disabled. Output pins are placed 
in a high-impedance state. 


Standby 


With Chip-Enable at a logic-high level, the standby 
operation disables most of the 28F020’s circuitry 
and substantially reduces device power consump- 
tion. The outputs are placed in a high-impedance 
state, independent of the Output-Enable signal. 
If the 28F020 is deselected during erasure, pro- 
gramming, or program/erase verification, the 
device draws: active current until the operation is 
terminated. 
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Intelligent Identifier Operation 


The Intelligent Identifier operation outputs the manu- 
facturer code (89H) and device code (BDH). Pro- 
gramming equipment automatically matches the de- 
vice with its proper erase and programming algo- 
rithms. 


With Chip-Enable and Output-Enable at a logic low 
level, raising AQ to high voltage Vip (see DC Charac- 
teristics) activates the operation. Data read from lo- 
cations OOOOH and O001H represent the manufac- 
turer’s code and the device code, respectively. 


The manufacturer- and device-codes can also be 
read via the command register, for instances where 
the 28F020 is erased and reprogrammezd in the tar- 
get system. Following a write of 90H to the com- 
mand register, a read from address location OOOOH 
outputs the manufacturer code (89H). A read from 
address 0001H outputs the device code (BDh). 


Write 


Device erasure and programming are accomplished 
via the command register, when high voltage is ap- 
plied to the Vpp pin. The contents of the register 
serve as input to the internal state-machine. The 
state-machine outputs dictate the function of the 
device. 


intel. 


The command register itself does not occupy an ad- 
dressable memory location. The register is a latch 
used to store the command, along with address and 
data information needed to execute the command. 


The command register is written by bringing Write- 
Enable to a logic-low level (Vj), while Chip-Enable is 
low. Addresses are latched on the falling edge of 
Write-Enable, while data is latched on the rising 
edge of the Write-Enable pulse. Standard microproc- 
essor write timings are used. 


Refer to AC Write Characteristics and the Erase/ 
Programming Waveforms for specific timing 
parameters. 


COMMAND DEFINITIONS 


When low voltage is applied to the Vpp pin, the con- 
tents of the command register default to 00H, en- 
abling read-only operations. 


Placing high voltage on the Vpp pin enables read/ 
write operations. Device operations are selected by 
writing specific data patterns into the command reg- 
ister. Table 3 defines these 28F020 register 
commands. 


Table 3. Command Definitions 


Bus 
Cycles 


First Bus Cycle 


Second Bus Cycle 


en cl we | he 
Read intiget enter Codes] e | wite | x | oo | heed | | 


sspcnsvrene® |e [me [of am | me [| a 


Erase Verify(5) 


NOTES: 
1. Bus operations are defined in Table 2. 


2. |A = Identifier address: OOH for manufacturer code, 01H for device code. 
EA = Address of memory location to be read during erase verify. 


PA = Address of memory location to be programmed. 


Addresses are latched on the falling edge of the Write-Enable pulse. 
3. |D = Data read from location IA during device identification (Mfr = 89H, Device = BDH). 


EVD = Data read from location EA during erase verify. 


PD = Data to be programmed at location PA. Data is latched on the rising edge of Write-Enable. 
PVD = Data read from location PA during program verify. PA is latched on the Program command. 
. Following the Read Intelligent ID command, two read operations access manufacturer and device codes. 


. Figure 6 illustrates the Quick-Erase Algorithm. 


4 
5 
6. Figure 5 illustrates the Quick-Pulse Programming Algorithm. 
7 


. The second bus cycle must be followed by the desired command register write. 
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Read Command 


While Vpp is high, for erasure and programming, 
memory contents can be accessed via the read 
command. The read operation is initiated by writing 
OOH into the command register. Microprocessor 
read cycles retrieve array data. The device remains 
enabled for reads until the command register con- 
tents are altered. 


The default contents of the register upon Vpp pow- 
er-up is OOH. This default value ensures that no spu- 
rious alteration of memory contents occurs during 
the Vpp power transition. Where the Vpp supply is 
hard-wired to the 28F020, the device powers-up and 
remains enabled for reads until the command-regis- 
ter contents are changed. Refer to the AC Read 
Characteristics and Waveforms for specific timing 
parameters. 


intelligent identifier Command 


Flash-memories are intended for use in applications 
where the local CPU alters memory contents. As 
such, manufacturer- and device-codes must be ac- 
cessible while the device resides in the target sys- 
tem. PROM programmers typically access signature 
codes by raising AQ to a high voltage. However, mul- 
tiplexing high voltage onto address lines is not a de- 
sired system-design practice. 


The 28F020 contains an Intelligent Identifier opera- 
tion to supplement traditional PROM-programming 
methodology. The operation is initiated by writing 
90H into the command register. Following the com- 
mand write, a read cycle from address OOOOH re- 
trieves the manufacturer code of 89H. A read cycle 
from address 0001H returns the device code of 
BDH. To terminate the operation, it is necessary to 
write another valid command into the register. 


Set-up Erase/Erase Commands 


Set-up Erase is a command-only operation that 
stages the device for electrical erasure of all bytes in 
the array. The set-up erase operation is performed 
by writing 20H to the command register. 


To commence chip-erasure, the erase command 
(20H) must again be written to the register. The 
erase operation begins with the rising edge of the 
Write-Enable pulse and terminates with the rising 
edge of the next Write-Enable pulse (i.e., Erase-Veri- 
fy Command). 


This two-step sequence of set-up followed by execu- 
tion ensures that memory contents are not acciden- 
tally erased. Also, chip-erasure can only occur when 
high voltage is applied to the Vpp pin. In the absence 
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of this high voltage, memory contents are protected 
against erasure. Refer to AC Erase Characteristics 
and Waveforms for specific timing parameters. 


Erase-Verify Command 


The erase command erases all bytes of the array in 
parallel. After each erase operation, all bytes must 
be verified. The erase verify operation is initiated by 
writing AOH into the command register. The address 
for the byte to be verified must be supplied as it is 
latched on the falling edge of the Write-Enable 
pulse. The register write terminates the erase opera- 
tion with the rising edge of its Write-Enable pulse. 


The 28F020 applies an internally-generated margin 
voltage to the addressed byte. Reading FFH from 
the addressed byte indicates that all bits in the byte 
are erased. 


The erase-verify command must be written to the 
command register prior to each byte verification to 
latch its address. The process continues for each 
byte in the array until a byte does not return FFH 
data, or the last address is accessed. 


In the case where the data read is not FFH, another 
erase operation is performed. (Refer to Set-up 
Erase/Erase). Verification then resumes from the 
address of the last-verified byte. Once all bytes in 
the array have been verified, the erase step is com- 
plete. The device can be programmed. At this point, 
the verify operation is terminated by writing a valid 
command (e.g. Program Set-up) to the command 
register. Figure 6, the Quick-Erase algorithm, illus- 
trates how commands and bus operations are com- 
bined to perform electrical erasure of the 28F020. 
Refer to AC Erase Characteristics and Waveforms 
for specific timing parameters. 


Set-up Program/Program Commands 


Set-up program is a command-only operation that 
stages the device for byte programming. Writing 40H 
into the command register performs the set-up 
operation. 


Once the program set-up operation is performed, 
the next Write-Enable pulse causes a transition to 
an active programming operation. Addresses are in- 
ternally latched on the falling edge of the Write-En- 
able pulse. Data is internally latched on the rising 
edge of the Write-Enable pulse. The rising edge of 
Write-Enable also begins the programming opera- 
tion. The programming operation terminates with the 
next rising edge of Write-Enable, used to write the 
program-verify command. Refer to AC Programming 
Characteristics and Waveforms for specific timing 
parameters. 
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Program-Verify Command 


The 28F020 is programmed on a byte-by-byte basis. - 


Byte programming may occur sequentially or at ran- 
dom. Following each programming operation, the 
byte just programmed must be verified. 


The program-verify operation is initiated by writing 
COH into the command register. The register write 
terminates the programming operation with the ris- 
ing edge of its Write-Enable pulse. The program-ver- 
ify operation stages the device for verification of the 
byte last programmed. No new address information 
is latched. 


The 28F020 applies an internally-generated margin 
voltage to the byte. A microprocessor read cycle 
outputs the data. A successful comparison between 
the programmed byte and true data means that the 
byte is successfully programmed. Programming then 
proceeds to the next desired byte location. Figure 5, 
the 28F020 Quick-Pulse Programming algorithm, il- 
lustrates how commands are combined with bus op- 
erations to perform byte programming. Refer to AC 
Programming Characteristics and Waveforms for 
specific timing parameters. 


Reset Command 


A reset command is provided as a means to safely 
abort the erase- or program-command sequences. 
Following either set-up command (erase or program) 
with two consecutive writes of FFH will safely abort 
the operation. Memory contents will not be altered. 
A valid command must then be written to place the 
device in the desired state. 


EXTENDED ERASE/PROGRAM CYCLING 


EEPROM cycling failures have always concerned 
users. The high electrical field required by thin oxide 
EEPROMs for tunneling can literally tear apart the 
oxide at defect regions. To combat this, some sup- 
pliers have implemented redundancy schemes, re- 
ducing cycling failures to insignificant levels. Howev- 
er, redundancy requires that cell size be doubled— 
an expensive solution. 


Intel has designed extended cycling capability into 
its ETOX flash memory technology. Resulting im- 
provements in cycling reliability come without in- 
creasing memory cell size or complexity. First, an 
advanced tunnel oxide increases the charge carry- 
ing ability ten-fold. Second, the oxide area per cell 
subjected to the tunneling electric field is one-tenth 
that of common EEPROMs, minimizing the probabili- 
ty of oxide defects in the region. Finally, the peak 
electric field during erasure is approximately 
2 MV/cm lower than EEPROM. The lower electric 
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field greatly reduces oxide stress and the probability 


of failure—increasing time to wearout by a factor of 
100,000,000. 


The 28F020 is capable of 100,000 program/erase 
cycles. The device is programmed and erased using 
Intel’s Quick-Pulse Programming and Quick-Erase 
algorithms. Intel’s algorithmic approach uses a se- 
ries of operations (pulses), along with byte verifica- 
tion, to completely and reliably erase and program 
the device. 


For further information, see Reliability Report RR-60. 


QUICK-PULSE PROGRAMMING ALGORITHM 


The Quick-Pulse Programming algorithm uses pro- 
gramming operations of 10 ws duration. Each opera- 
tion is followed by a byte verification to determine 
when the addressed byte has been successfully pro- 
grammed. The algorithm allows for up to 25 pro- 
gramming operations per byte, although most bytes 
verify on the first or second operation. The entire 
sequence of programming and byte verification is 
performed with Vpp at high voltage. Figure 5 illus- 
trates the Quick-Pulse Programming algorithm. 


QUICK-ERASE ALGORITHM 


Intel’s Quick-Erase algorithm yields fast and reliable 
electrical erasure of memory contents. The algo- 
rithm employs a closed-loop flow, similar to the 
Quick-Pulse Programming algorithm, to simulta- 
neously remove charge from all bits in the array. 


Erasure begins with a read of memory contents. The 
28F020 is erased when shipped from the factory. 
Reading FFH data from the device would immedi- 
ately be followed by device programming. 


For devices being erased and reprogrammed, uni- 
form and reliable erasure is ensured by first pro- 
gramming all bits in the device to their charged state 
(Data = OOH). This is accomplished, using the 
Quick-Pulse Programming algorithm, in approxi- 
mately four seconds. 


Erase execution then continues with an initial erase 
operation. Erase verification (data = FFH) begins at 
address 0000H and continues through the array to 
the last address, or until data other than FFH is en- 
countered. With each erase operation, an increasing 
number of bytes verify to the erased state. Erase 
efficiency may be improved by storing the address of 
the last byte verified in a register. Following the next 
erase operation, verification starts at that stored ad- 
dress location. Erasure typically occurs in two sec- 
onds. Figure 6 illustrates the Quick-Erase algorithm. 
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NOTES: 3. Refer to principles of operation. 


1. See DC Characteristics for the value of Vppy and 
VppL. 4. CAUTION: The algorithm MUST BE FOLLOWED 


2. Program Verify is only performed after byte program- to ensure proper and reliable operation of the de- 
ming. A final read/compare may be performed (option- vice. 
al) after the register is written with the Read command. 


Figure 5. 28F020 Quick-Pulse Programming Algorithm 


28F020 


Start (4) 
Erasure 


Program All 
Bytes to OOH 


Apply 
Vppu [1] 


ADDR = OOH 
PLSCNT =0 


Write Erase 
Set-up Cmd 
Write 
Erase Cmd 
Time Out 10 ms 
Write Erase 
Verify Cmd 
Time Out 6 us 


Read Data 
from Device 


Increment 
Address 


Write 
Read Cmd 


Apply 
Vppt [1] 


Erasure 
Completed 
290245-8 

1. See DC Characteristics for the value of Vppy and 
VPPL- 

2. Erase Verify is performed only after chip-erasure. A 
final read/compare may be performed (optional) after 
the register is written with the read command. 


intel. 


Bus 


Entire Memory Must = 00H 
Before Erasure 


Use Quick-Pulse 
Programming Algorithm 
(Figure 5) 


Wait for Vpp Ramp to Vppp(1) 


Initialize Addresses and 
Pulse-Count 


Data = 20H 


Data = 20H 


Duration of Erase Operation 
(twHWH2) 


Erase(2) Addr = Byte to Verify; 
Verify Data = AOH; Stops Erase 
Operation(S) 

tWHGL 


Read Byte to Verify Erasure 


Standby Compare Output to FFH 


Increment Pulse-Count 


Data = OOH, Resets the 
Register for Read Operations 


Wait for Vpp Ramp to Vpp, (1) 


3. Refer to principles of operation. 


4. CAUTION: The algorithm MUST BE FOLLOWED 
to ensure proper and reliable operation of the de- 
vice. 


Figure 6. 28F020 Quick-Erase Algorithm 
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DESIGN CONSIDERATIONS 


Two-Line Output Control 


Flash-memories are often used in larger memory ar- 


rays. Intel provides two read-control inputs to ac- - 


commodate multiple memory connections. Two-line 
control provides for: 


a. the lowest possible memory power dissipation 
and, 

b. complete assurance that output bus contention 
will not occur. 


To efficiently use these two control inputs, an ad- 
dress-decoder output should drive chip-enable, 
while the system’s read signal controls all flash- 
memories and other parallel memories. This assures 
that only enabled memory devices have active out- 
puts, while deselected devices maintain the low 
power standby condition. 


Power Supply Decoupling 


Flash-memory power-switching characteristics re- 
quire careful device decoupling. System designers 
are interested in three supply current (Icc) issues— 
standby, active, and transient current peaks pro- 
duced by falling and rising edges of chip-enable. The 
Capacitive and inductive loads on the device outputs 
determine the magnitudes of these peaks. 


Two-line control and proper decoupling capacitor 
selection will suppress transient voltage peaks. 
Each device should have a 0.1 F ceramic capacitor 
connected between Vcc and Vss, and between Vpp 
and Vss. . 


Place the high-frequency, low-inherent-inductance 
capacitors as close as possible to the devices. Also, 
for every eight devices, a 4.7 uF electrolytic capaci- 
tor should be: placed at the array’s power supply 
connection, between Vcc and Vss. The bulk capaci- 
tor will overcome voltage slumps caused by printed- 
circuit-board trace inductance, and will supply 
charge to the smaller capacitors as needed. 


Vpp Trace on Printed Circuit Boards 


Programming flash-memories, while they reside in 
the target system, requires that the printed circuit 
board designer pay attention to the Vpp power sup- 
ply trace. The Vpp pin supplies the memory cell cur- 
rent for programming. Use similar trace widths and 
layout considerations given the Vcc power bus. Ad- 
equate Vpp supply traces and decoupling will de- 
crease Vpp voltage spikes and overshoots. 


28F020 


Power Up/Down Protection 


The 28F020 is designed to offer protection against 
accidental erasure or programming during power 
transitions. Upon power-up, the 28F020 is indifferent 
as to which power supply, Vpp or Voc, powers up 
first. Power supply sequencing is not required. 
Internal circuitry in the 28F020 ensures that the 
command register is reset to the read mode on pow- 
er up. 


A system designer must guard against active writes 
for Vcc voltages above Vi xo when Vpp is active. 
Since both WE# and CE# must be low for a com- 
mand write, driving either to Viy will inhibit writes. 
The control register architecture provides an added 
level of protection since alteration of memory con- 
tents only occurs after successful completion of the 
two-step command sequences. 


28F020 Power Dissipation 


When designing portable systems, designers must 
consider battery power consumption not only during 
device operation, but also for data retention during 
system idle time. Flash nonvolatility increases the 
usable battery life of your system because the 
28F020 does not consume any power to retain code 
or data when the system is off. Table 4 illustrates the 
power dissipated when updating the 28F020. 


Table 4. 28F020 Typical 
Update Power Dissipation(4) 


Power Dissipation 
(Watt-Seconds) 


Array Erase/Erase Verify 
One Complete Cycle 


NOTES: 

1. Formula to calculate typical Program/Program Verify 
Power = [Vpp X # Bytes xX typical # Prog Pulse 
(twHWH1 X Ippo typical + twHaL x !ppq typical)] + [Voc 
x # Bytes X typical # Prog Pulses (twHwxH1  !cco typi- 
cal + twHaL = Icca typical)]. 

2. Formula to calculate typical Erase/Erase Verify Power 
= [Vpp (Ipp3 typical < teRase typical + Ipps typical x 
twHaL < # Bytes)] + [Vcc (ccs typical < teRase typical 
+ Iccs typical X twHaL < # Bytes)]. 

3. One Complete Cycle = Array Preprogram + Array 
Erase + Program. 

4. “Typicals” are not guaranteed but based on a limited 
number of samples from 28F020-150 production lots. 


0.37 
1.05 


Array Program/Program Verify bet 0.34 
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ABSOLUTE MAXIMUM RATINGS* 


Operating Temperature - 
Brubiiicl aah. 5, <etaes che pnenys 0°C to + 70°C(1) * WARNING: Stressing the device beyond the “Absolute 
During Erase/Program ......... O’C to +70°C(1) | Maximum Ratings” may cause permanent damage. 

These are stress ratings only. Operation beyond the 

“Operating Conditions” is not recommended and ex- 


NOTICE: This is a production data sheet. The specifi- 
cations are subject to change without notice. 


Operating Temperature 


During Read ............... —40°C to + 85°C) tended exposure beyond the “Operating Conditions” 
During Erase/Program ...... —40°C to + 85°C(2) may affect device reliability. 
Temperature Under Bias.......—10°C to +80°C(1) 
Temperature Under Bias....... —50°C to + 95°C(2) 
Storage Temperature .......... —65°C to + 125°C 
Voltage on Any Pin with 
Respect to Ground.......... —2.0V to +7.0V(2) 
Voltage on Pin Ag with } 
Respect to Ground....... —2.0V to + 13.5V(2, 3) 


Vpp Supply Voltage with 
Respect to Ground 


During Erase/Program....—2.0V to + 14.0V(2, 3) 
Vcc Supply Voltage with 

Respect to Ground.......... —2.0V to +7.0V(2) 
Output Short Circuit Current............. 100 mA(4) 
NOTES: 


1. Operating temperature is for commercial product defined by this specification. 

2. Operating temperature is for extended temperature product as defined by this specification. 

3. Minimum DC input voltage is —0.5V. During transitions, inputs may undershoot to —2.0V for periods less 
than 20 ns. Maximum DC voltage on output pins is Voc + 0.5V, which may overshoot to Voc + 2.0V for 
periods less than 20 ns. 

4. Maximum DC voltage on Ag or Vpp may overshoot to + 14.0V for periods less than 20 ns. 

5. Output shorted for no more than one second. No more than one output shorted at a time. 

6. See AC Input/Output reference Waveforms and AC Testing Load Circuits for testing characteristics. 

7. See High Speed AC Input/Output reference Waveforms and High Speed AC Testing Load Circuits for 
testing characteristics. 


OPERATING CONDITIONS 


Operating Temperature) ||| 


i 
Operating Temperature) =40 
| 


Voc Supply Voltage (10%)(6) 


Vcc Supply Voltage (5%)(7) 


DC CHARACTERISTICS—TTL/NMOS COMPATIBLE—Commercial Products 


Limits 
a Noten | tint hncurk 
Vin = Voc or Vss 
Vout = Vcc or Vss 
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intel ie | ee | 28F020 


DC CHARACTERISTICS—TTL/NMOS COMPATIBLE—Commercial 
Products (Continued) 


Limits 
herenotet sete Test Conditions 
CE# = Vin 
| f = 6 MHz, lout = OmA 


A 
A 
Voc Programming Current fee. 1.0 Programming in Progress 
A 
mA 


loca Vcc Program Verify Current Age 15 mA |Vpp = Vppp, 

Program Verify in Progress 
locs Vcc Erase Verify Current 1,2 15 Vpp = Vppp; 

Erase Verify in Progress 
lpps__|Vpp Leakage Current fae Ok ova A eee 
ippt_|Vpp Read Current, ID Current | 1 | 90 | 200 | nA 
Vpp Programming Current 1,2 mA |Vpp = VppyH 

Programming in Progress 


Vpp Program Verify Current 1,2 mA |Vpp = Vppy, 
Program Verify in Progress 


IPp3 


U 
& 


Vpp Erase Verify Current 1ye mA |Vpp = Vppp, 
Erase Verify in Progress 
W__| Input High Voltage es a a ee 
OL Output Low Voltage oe 
VouHi | Output High Voltage V jiloy = —2.5mA 
Voc = Vcc Min 
Vip _|Ag Intelligent Identifer ei 


Voltage 


Ag Intelligent Identifier a: 
Current 

Vpp during Read-Only 
Operations 


Vpp during Read/Write 
Operations 


on 
Oo 
E 
& 
on 
i 
or 
QO 
rik 
Be 
S @ 
wa. 
=> 
= 


< < < 
‘ith U v 
A Uv U 
O 8 e 


Voc Erase/Write Lock Voltage 
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28F020 . ‘ ntal é 


Vin = ee or Vss 
vane = Voc or Vss 
, ape 


100 BA |Voc = Voc Max 
CE# = Voc +0.2V 
loci Voc Active Read Current 1 10 mA |Vcc = Voc Max, CE# = Vi. 
f = 6 MHz, lout = OMA 


Icc2___|Vcc Programming Current , 2 St ede 10 Lee ven in Progress 
Icca__|Voc Erase Current Ee ee el ate aoe 


loca Voc Program Verify Current} 1, mA |Vpp = Vppp, Program 
Verify in Progress 
locs Voc Erase Verify mA |Vpp = Vppp, 
Current Erase Verify in Progress 
Vpp Leakage Current at Vpp < Vcc 
Vpp Read Current, / 200 | pA Vpp > Voc 
ID Current or 
+10 Vpp < V 
Standby Current ae pP < Voc 
Vpp Programming i.e mA |Vpp = Vppp, 
Current Programming in Progress 
10 mA |Vpp = VppH; 
Erasure in Progress 
Ipp4 Vpp Program Verify mA |Vpp = Vppp, 
Current Program Verify in Progress 
Vpp Erase Verify mA |Vpp = Vppp, 
Current Erase Verify in Progress 
Vi.__|Input Low Voltage Sores aS es a 
Vin |Input High Voltage aan ts 


Output Low Voltage 0.45 lo. = 5.8 mA 
es = Vcc Min 


= fe] |_| Rew 
Output High Voltage 6 ae 
os lon = —100 neoae! a 
ton Noo ~ 04 ey a = Voc Min 
Ag Intelligent Identifer 11.50 13.00 
Voltage 
Ag Intelligent Identifier 1,2 pA ec Ra = Vip 
Current 
Vpp_ |Vpp during Read-Only V |NOTE: Erase/Programs are 
Operations Inhibited when Vpp = Vpp,_ 
Vppy |Vpp during Read/Write 11.40 V 
Operations 
Vico’ |Vcc Erase/Write Lock V 
Voltage 
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intel : | | 28F020 


is hol aia inenieelaee eis COMPATIBLE—Extended Temperature 
roducts 


eo 
ee 
Vin = Voc or Vsg 
eee eee 
Vout = Voc or Vss 
oo increta 2 el 3 cat 
CE# = Vin 
f = 6 MHz, lout = OMA 


mg Voc Sn a aaa Current eff / 1.0} 30 | mA ee in Progress 
locs__|Voc Erase Current | 5.0 | 30 | mA|Erasurein Progress 


loca Vcc Program Verify Current 1, 2 mA |Vpp = Vppy, 

Program Verify in Progress 
locs Vcc Erase Verify Current ae mA |Vpp = Vppp, 

Erase Verify in Progress 


or Standby Current Vpp < Voc 


Vpp Programming Current as Vpp = VppyH 
Programming in pepaiges 


leo Vpp Program Verify re Ease Core. —_ 1, 2 mA |Vpp = Vppp, 
Program Verify in Progress 
Vpp Erase Verify Current 1,2 mA |Vpp = Vppp, 
ee Verify in Saeco 


Ma fe Low InputLow Voltage 


Min___|Input High Voltage a fo] hese] 


Output Low Voltage 0.45 lo. = 5.8 mA 

Voc = Vcc Min 

VouHi | Output High Voltage V |jlon = —2.5mA 
Voc = Vcc Min 

Ag Intelligent Identifer 11.50 13.00 V 

Voltage 

Ag Intelligent Identifier 1,2 

Current 


Vpp_ _| Vpp during Read-Only V |NOTE: Erase/Program are 
Operations Inhibited when Vpp = Vpp. 
VppyH _ | Vpp during Read/Write 11.40 

Operations 
iia 3 


Voc Erase/Write Lock Voltage ro 


12.60 V 


28F020 


DC CHARACTERISTICS—CMOS COMPATIBLE—Extended Temperature 


Products 


Voc Programming Current 
Voc Erase Current 


Vcc Program Verify Current] 1, 2 


Voc Erase Verify 
Current 


Vpp Leakage Current 


Ipp4 Vpp Read Current, 
ID Current or 
Standby Current 


Vpp Programming 1,2 
Current 

Vpp Erase Current 

Vpp Program Verify 12 
Current : 

Vpp Erase Verify ye 
Current 


Input Low Voltage 
Input High Voltage 0. 


Output Low Voltage 


Output High Voltage 


—_ 


=e a" 
ine) ine) 


V 
V 


N 

< 
QO 
1) 


IL 
IH 
VoL 
VOH1 


VoH2 
gos 


ID Ag Intelligent Identifer 

Voltage 
Ag Intelligent Identifier 1,2 
Current 

Vpp_ __| Vpp during Read-Only 
Operations 

VppH  |Vpp during Read/Write 
Operations 


Viko {Vcc Erase/Write Lock 
Voltage 


Voc = Vcc Max 
CE# = Voc +0.2V 


Voc = Vcc Max, CE# = Vi. 
f = 6 MHz, lout = OMA 


Vpp = Vppp, Program 
Verify in Progress 


Vpp = VpPH; 
Erase Verify in Progress 


LA |\Vpp > Voc 


mA |Vpp = VppH, 
Programming in Progress 


Vpp = VpPH; 
Erasure in Progress 


Vpp = VppH; 
Program Verify in Progress 


Vpp = VppH; 
Erase Verify in Progress 


Voc = Vcc Min 


lon. = —100 pA, 
Voc = Vcc Min 


intel. 


CAPACITANCE Ta = - 25°C, f = 1.0 MHz 


Address/Control Capacitance 
Output Capacitance 


NOTES for DC Characteristics and Capacitance: 


are valid for all product versions (packages and speeds). 
2. Not 100% tested: Characterization data available. 
3. Sampled, not 100% tested. 


Parameter Notes 


1. All currents are in RMS unless otherwise noted. Typical values at Voc = 


28F020 


| Min | Max | 
PaO (ek BME 
Bee 


5.0V, Vpp = 12.0V, T = 25°C. These currents 


4. “Typicals” are not guaranteed, but based on a limited number of samples from production lots. 


TESTING INPUT/OUTPUT WAVEFORM(1) 


~ INPUT lies 7° OUTPUT 
TEST POINTS 
0.45 0.8 0.8 


290245-21 


AC test inputs are driven at Voy (2.4 Vrt_) for a Logic 
“1” and Vo. (0.45 Vrq_) for a Logic “0”. Input timing 
begins at Viy (2.0 Vrz_) and Vi, (0.8 Vr7_). Output tim- 
ing ends at Vj and Vj,. Input rise and fall times (10% 
to 90%) <10 ns. 


AC TESTING LOAD CIRCUIT(1) 


DEVICE 
UNDER 
TEST 


290245-23 


C. = 100 pF 
C. includes Jig Capacitance 
Ru = 3.3 ko 


AC TEST CONDITIONS(1) 


Input Rise and Fall Times (10% to 90%)...... 10 ns 
Input Pulse Levels .............08.ee8. 0.45 and 2.4 
Input Timing Reference Level .......... 0.8 and 2.0 
Output Timing Reference Level......... 0.8 and 2.0 
CADSCHING LOATO) oyu oes «x fdae es Ga oes oe 100 pF 
NOTES: 


HIGH SPEED AC TESTING INPUT/OUTPUT 
WAVEFORMS(2) 


3.0 cu = is cuor 
INPUT 1.5 9 <———— TEST POINTS > #% 1.5 OUTPUT 
0.0 ; 


290245-22 


AC test inputs are driven at 3.0V for a Logic 1” and 
0.0V for a Logic ‘0’. Input timing begins, and output 
timing ends, at 1.5V. Input rise and fall times (10% to 
90%) <10 ns. 


HIGH SPEED AC TESTING LOAD CIRCUIT(2) 


DEVICE 
UNDER 
TEST 


290245-24 


CL = 30 pF 
C, includes Jig Capacitance 
R_ = 3.3 kN 


HIGH SPEED AC TEST CONDITIONS(2) 


Input Rise and Fall Times (10% to 90%)...... 10 ns 
input Pulse Level... ... . ecu daveecee- 0.0 and 3.0 
Input Timing Reference Level ................. TS 
Output Timing Reference Level................ 15 
Canacive Oa Cyn yecc cs dae eases rede eye 30 pF 


1. Testing characteristics for 28F020-70 in standard configuration, and 28F020-90 and 28F020-150. 
2. Testing characteristics for 28FO20-70 in high speed configuration. 
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AC CHARACTERISTICS—Read Only Operations—Commercial and Extended Temperature Products 


Vcc + 5% 28F020-70(4) 
Vcc + 10% 


Notes 


28F020-70(5) 28F020-90(5) 


Versions 


~S 


S 
2) 


Characteristics 


~S 
oO 


Read Cycle Time 


Chip Enable 
Access Time 


tavav/trc 
teLav/tce 


Address Access Time 


Output Enable 
Access Time 


Chip Enable to 
Output in Low Z 


Chip Disable to 
Output in High Z 


teLox/toLz | Output Enable to 
Output in Low Z 


Output Disable to 
Output in High Z 


Output Hold from 
Address, CE #, or 
OE # Change 


tavav/tacc 
tacav/toe 


teLax/tLz 


tEHQZ 


ig 
a) 


cake 
MN 


N 
a) 


NOTES: 

1. Whichever occurs first. 

2. Sampled, not 100% tested. 

3. Guaranteed by design. 

4. See High Speed AC Input/Output reference Waveforms and High Speed AC Testing Load Circuits for testing characteristics. 
5. See AC Input/Output reference Waveforms and AC Testing Load Circuits for testing characteristics. 


020482 


La-S 


SuO}}e1edO peay JO} SWOJOAEM OV *Z OuNBI4 


ADDRESSES 


CE# (E#) 


OE# (G#) 


WE# (W#) 


DATA (DO) 


Veco POWER-UP STANDBY AONESS SELECION OUTPUTS ENABLED DATA VALID STANDBY Voc POWER-DOWN 
XX KKK XK XK ADDRESS STABLE POON 
AN AN AN AN AN AX Angee ie LV VV VN 
tune (tee) 
yak ts *eHOz 
—_—— — (tor) 
cece 
teav (toe) 
trav (tee) 
terax (torz) —>| ton 
terax (tz) —— 


VALID OUTPUT WANK HIGH Z 
[LLY 


Aaeat tavav (tacc) 
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on Se a eee eee Only Operations(1)—Commercial and Extended Temperature 
roducts ' | 


A A od Pe eee en ea ed 
Veo+10% |  ———s«|_—s 2020-7018) 28F020-90(5) 28F020-150(5) 
Notes | Min pin pin 


Versions 


Characteristics 


Write Cycle Time 
Address Set-Up Time 


tWLax/taH Address Hold Time 


Data Set-Up Time 


Data Hold Time 
tWHGL Write Recovery Time 
before Read 
tGHWL Read Recovery Time 
before Write 
teLwe/ Chip Enable Set-Up 
tcs Time before Write 
tWHEH/ Chip Enable Hold Time 
‘CH 
Write Pulse Width 
twWHWL/ Write Pulse Width High 
twPH 
Duration of Programming 
Operation 


 — 
” 


40 
10 


: 


Duration of Erase 
Operation 


tvPEL Vpp Set-Up Time to 
Chip Enable Low 


NOTES: 

1. Read timing characteristics during read/write operations are the same as during read-only operations. Refer to AC Characteristics for Read-Only Operations. 
2. Guaranteed by design. 

3. The integrated stop timer terminates the programming/erase operations, thus eliminating the need for a maximum specification. 

4. See High Speed AC Input/Output reference Waveforms and High Speed AC Testing Load Circuits for testing characteristics. 

5. See AC Input/Output reference Waveforms and AC Testing Load Circuits for testing characteristics. 

6. Minimum Specification for Extended Temperature product. 
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ERASE AND PROGRAMMING PERFORMANCE 


parameter | Notes |S nt 


[chipesotime [aaa | 2 | 90 | Soo 
[chip Progamtine [1.4 | | 4 | 26 | Seo 


NOTES: 


28F020 


1. “Typicals” are not guaranteed, but based on a limited number of samples from production lots. Data taken at 25°C, 12.0V 


Vpp at 0 cycles. 


2. Minimum byte programming time excluding system overhead is 16 sec (10 usec program + 6 psec write recovery), 
while maximum is 400 wsec/byte (16 wsec x 25 loops allowed by algorithm). Max chip programming time is specified lower 
than the worst case allowed by the programming algorithm since most bytes program significantly faster than the worst case 


byte. 
3. Excludes 00H Programming prior to Erasure. 
4. Excludes System-Level Overhead. 


5. Refer to RR-60, 69 ‘ETOX Flash Memory Reliability Data Summaries” for typical cycling data and failure rate calculations. 
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Chip Program Time (Sec) 
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eocccees 11.4v; 10ke: 70C 
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Figure 8. 28F020 Typical Programming Capability 
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Figure 9. 28F020 Typical Program Time at 12V 
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NOTE: 
Does not include Pre-Erase Program. 


Figure 10. 28F020 Typicai Erase Capability 
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NOTE: 
Does not include Pre-Erase Program. 


Figure 11. 28F020 Typical Erase Time at 12.0V 
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PROGRAM 
Voc POWER-UP & SET-UP PROGRAM PROGRAM COMMAND VERIFY PROGRAM STANDBY / 
STANDBY COMMAND LATCH ADDRESS & DATA PROGRAMMING COMMAND VERIFICATION Voc POWER-DOWN 


{NY 


tavav (tec) 


—~ OOO RON ORD 
tavav (two) tavav (two) 


tavav (two) 
tavWL 


CE# (E#) 
ij 
tcHWL ate | ao 
| ao 
ee Es. 
all \ 
HIGH Z Uf, ea ) 
oat (00 fran) {oxram ees ous (CP od 
OUT 
») 
terax (tz) 
teLav 
(tog) 
5.0V 
Voc 
OV 
tVPEL 
12.0V 
Vpp 


020482 


— 


VPPL 
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ERASE 
Voc POWER-UP & SET-UP ERASE VERIFY ERASE STANDBY / 
STANDBY COMMAND ERASE COMMAND ERASING COMMAND VERIFICATION Voc POWER-DOWN 


— YOO MOO __ WO) 


CE# (E#) 


OE# (G#) 


WE# (W#) 


DATA (DQ) 


v 


/, 


tavav (two) tavav (two) tavav (wc) tavav (tee) | 


tavwe (tas) 


tweax (tan) 


twHEH teLWL tWHEH teLWe 


(ton) (tes) (tow) (tes) 


pel 
(ian ee (op) 
twi wir umm twi wi if wf 
twHDx i tou 
tovwH tovwi 
HIGH Z MV vatip \ 
( ore } (| DATAIN J\ ( aot ) ( (( DATA ») 


{/ 
i 
= 20H \ 
a xis. 
trax (tz) 


teLav 
(toe) 


tVPEL 
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AC CHARACTERISTICS—Alternate CE# Controlled Writes—Commercial and Extended Temperature Products 
Veo+10% | i 28F020-7015) | 28F 020-9015) | 28F020-150(5) 


Versions 


| Symbol | Characteristics 
Write Cycle Time 
Address Set-Up Time 


Address Hold Time 
Data Set-Up Time 


Data Hold Time 
tEHGL Write Recovery Time 
before Read 
tGHWL Read Recovery Time 
before Write 
tWLEL Write Enable Set-Up Time 
before Chip Enable 


Write Enable Hold Time 


Write Pulse Width 


Write Pulse Width High 


tEHEH1 Duration of Programming 
Operation 


Duration of Erase Operation 


Vpp Set-Up Time to 


Chip Enable Low 
NOTES: 


1. Read timing characteristics during read/write operations are the same as during read-only operations. Refer to AC Characteristics for Read-Only Operations. 
2. Guaranteed by design. 

3. The integrated stop timer terminates the programming/erase operations, thus eliminating the need for a maximum specification. 

4. See High Speed AC Input/Output reference Waveforms and High Speed AC Testing Load Circuits for testing characteritics. 

5. See AC Input/Output reference Waveforms and AC Testing Load Circuits for testing characteristics. 

6. Minimum specification for Extended Temperature product. 
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ORDERING INFORMATION 


EOROGOROeooouoo 
TEMPERATURE RANGE Rao PACKAGE | aa LER CODE 
P 


T = EXTENDED (-40°C TO +55°C) P = 32-PIN PLASTIC DI 
BLANK = COMMERCIAL (0°C TO +70°C) 32-LEAD PLCC ACCESS SPEED (ns) 


N= 
E = STANDARD 32-LEAD TSOP a bs 
F = REVERSE 32-LEAD TSOP 
150 ns 
200 ns 
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VALID COMBINATIONS: 
P28F020-70 N28F020-70 TN28F020-90 
P28F020-90 N28F020-90 

P28F020-150 N28F020-150 


E28F020-70 F28F020-70 TE28F020-90 
E28F020-90 F28F020-90 TF28F020-90 
E28F020-150 F28F020-150 


ADDITIONAL INFORMATION REVISION HISTORY 


Order 
Number 

ER-20,  “ETOX Flash Memory 294005 Removed Preliminary 

Technology” Classification. Clarified AC and DC 

| test conditions. Added “‘dimple”’ to F 

ER-24, “Intel Flash Memory” 294008 TSOP package. Corrected 
ER-28, “ETOX Ill Flash Memory 294012 serpentine layout. 

TeGnnoogy Added -80V05, -90 ns speed grades. 
RR-60, “ETOX Flash Memory 293002 Added extended temperature 

Reliability Data Summary” devices. Corrected AC Waveforms. 


AP-316, ‘‘Using Flash Memory for In- 292046 
System Reprogrammable 
Nonvolatile Storage” 


Added -70 ns speed. 
Deleted -80V05 speed. 


Revised symbols, i.e., CE, OE, etc. 
AP-325 “Guide to Flash Memory 292059 BCE. OEK ete, , 


Reprogramming”’ 
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: 28F010 
1024K (128K x 8) CMOS FLASH MEMORY 
@ Flash Electrical Chip-Erase m= Command Register Architecture for 
— 1 Second Typical Chip-Erase Microprocessor/Microcontroller 
m Quick Pulse Programming Algorithm Compatible Write Interface 
— 10 us Typical Byte-Program m@ Noise Immunity Features 
— 2 Second Chip-Program — +10% Vcc Tolerance 


— Maximum Latch-Up Immunity 
through EPI Processing 


m ETOX Nonvolatile Flash Technology 


m 100,000 Erase/Program Cycles 
m 12.0V +5% Vpp 


m High-Performance Read — EPROM-Compatible Process Base 
— 65 ns Maximum Access Time — High-Volume Manufacturing 
m CMOS Low Power Consumption Experience 
— 10 mA Typical Active Current _  JEDEC-Standard Pinouts 
— 50 yA Typical Standby Current — 32-Pin Plastic Dip 
— 0 Watts Data Retention Power — 32-Lead PLCC 
m Integrated Program/Erase Stop Timer — 32-Lead TSOP 


(See Packaging Spec., Order #231369) 
m@ Extended Temperature Options 


Intel’s 28F010 CMOS flash memory offers the most cost-effective and reliable alternative for read/write 
random access nonvolatile memory. The 28F010 adds electrical chip-erasure and reprogramming to familiar 
EPROM technology. Memory contents can be rewritten: in a test socket; in a PROM-programmer socket; on- 
board during subassembly test; in-system during final test; and in-system after-sale. The 28F010 increases 
memory flexibility, while contributing to time and cost savings. 


The 28F010 is a 1024 kilobit nonvolatile memory organized as 131,072 bytes of 8 bits. Intel’s 28F010 is 
offered in 32-pin plastic dip or 32-lead PLCC and TSOP packages. Pin assignments conform to JEDEC 
standards for byte-wide EPROMs. 


Extended erase and program cycling capability is designed into Intel’s ETOX (EPROM Tunnel Oxide) process 
technology. Advanced oxide processing, an optimized tunneling structure, and lower electric field combine to 
extend reliable cycling beyond that of traditional EEPROMs. With the 12.0V Vpp supply, the 28F010 performs 
100,000 erase and program cycles well within the time limits of the Quick Pulse Programming and Quick Erase 
algorithms. 


Intel’s 28F010 employs advanced CMOS circuitry for systems requiring high-performance access speeds, low 
power consumption, and immunity to noise. Its 65 nanosecond access time provides no-WAIT-state perform- 
ance for a wide range of microprocessors and microcontrollers. Maximum standby current of 100 yA trans- 
lates into power savings when the device is deselected. Finally, the highest degree of latch-up protection is 
achieved through Intel’s unique EPI processing. Prevention of latch-up is provided for stresses up to 100 mA 
on address and data pins, from —1V to Voc + 1V. 


With Intel’s ETOX process base, the 28F010 levers years of EPROM experience to yield the highest levels of 
quality, reliability, and cost-effectiveness. 


October 1993 
Order Number: 290207-009 5-33 
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Figure 1. 28F010 Block Diagram 


= Table 1. Pin Description 


Name and Function 


Ao-Ai6 INPUT ADDRESS INPUTS for memory addresses. Addresses are internally 
latched during a write cycle. | 
DQ 9-DQ7 | INPUT/OUTPUT | DATA INPUT/OUTPUT: Inputs data during memory write cycles; 
outputs data during memory read cycles. The data pins are active high 
ie 
and data is latched on the rising edge of the WE # pulse. 
Note: With Vpp < 6.5V, memory contents cannot be altered. 


and float to tri-state OFF when the chip is deselected or the outputs 
INPUT 
INPUT 
ag ERASE/PROGRAM POWER SUPPLY for writing the command 


CHIP ENABLE: Activates the device’s control logic, input buffers, 
decoders and sense amplifiers. CE # is active low; CE # high 

deselects the memory device and reduces power consumption to 
standby levels. 


OUTPUT ENABLE: Gates the devices output through the data buffers 
during a read cycle. OE # is active low. 


WRITE ENABLE: Controls writes to the control register and the array. 
Write enable is active low. Addresses are latched on the falling edge 


are disabled. Data is internally latched during a write cycle. 
register, erasing the entire array, or programming bytes in the array. 
DEVICE POWER SUPPLY (5V + 10%) 


NO INTERNAL CONNECTION to device. Pin may be driven or left 
floating. 
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P28F010 N28F010 
32-LEAD 32 - LEAD PLCC 
P-DIP 0.450" x 0.550" 
0.62"x1.64" TOP VIEW 
TOP VIEW 10 
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STANDARD PINOUT 
E28F010 
32-LEAD TSOP 
O13 1" x-0.72" 
TOP VIEW 


< 


REVERSE PINOUT 
F28F010 
32-LEAD TSOP 
G.2t” #-O.72T 
TOP VIEW 


On OU kt WD =~ 


Figure 2. 28F010 Pin Configurations 
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APPLICATIONS 


The 28F010 flash memory provides nonvolatility 
along with the capability to perform over 100,000 
electrical chip-erasure/reprogram cycles. These fea- 
tures make the 28F010 an innovative alternative to 
- disk, EEPROM, and battery-backed static RAM. 
Where periodic updates of code and data-tables are 
required, the 28F010’s reprogrammability and non- 
volatility make it the obvious and ideal replacement 
for EPROM. 


Primary applications and operating systems stored 
in flash eliminate the slow disk-to-DRAM download 
process. This results in dramatic enhancement of 
performance and substantial reduction of power 
consumption — a consideration particularly impor- 
tant in portable equipment. Flash memory increases 
flexibility with electrical chip erasure and in-system 
update capability of operating systems and applica- 
tion code. With updatable code, system manufactur- 
ers can easily accommodate last-minute changes as 
revisions are made. 


In diskless workstations and terminals, network traf- 
fic reduces to a minimum and systems are instant- 
on. Reliability exceeds that of electromechanical 
media. Often in these environments, power interrup- 
tions force extended re-boot periods for all net- 
worked terminals. This mishap is no longer an issue 
if boot code, operating systems, communication pro- 
tocols and primary applications are flash-resident in 
each terminal. 


For embedded systems that rely on dynamic RAM/ 
disk for main system memory or nonvolatile backup 
storage, the 28F010 flash memory offers a solid 
state alternative in a minimal form factor. The 
28F010 provides higher performance, lower power 
consumption, instant-on capability, and allows an 
“execute in place” memory hierarchy for code and 
data table reading. Additionally, the flash memory is 
more rugged and reliable in harsh environments 
where extreme temperatures and shock can cause 
disk-based systems to fail. 


The need for code updates pervades all phases of a 
system’s life — from prototyping to system manufac- 
ture to after-sale service. The electrical chip-erasure 
and reprogramming ability of the 28F010 allows in- 
circuit alterability; this eliminates unnecessary han- 
dling and less-reliable socketed connections, while 
adding greater test, manufacture, and update flexi- 
bility. 
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Material and labor costs associated with code 
changes increases at higher levels of system inte- 
gration — the most costly being code updates after 
sale. Code ‘“‘bugs’’, or the desire to augment system 
functionality, prompt after-sale code updates. Field 
revisions to EPROM-based code requires the re- 
moval of EPROM components or entire boards. With 
the 28F010, code updates are implemented locally 
via an edge-connector, or remotely over a commun- 
cation link. 


For systems currently using a high-density static 
RAM/battery configuration for data accumulation, 
flash memory’s inherent nonvolatility eliminates the 
need for battery backup. The concern for battery 
failure no longer exists, an important consideration 
for portable equipment and medical instruments, 
both requiring continuous performance. In addition, 
flash memory offers a considerable cost advantage 
over static RAM. 


Flash memory’s electrical chip erasure, byte pro- 
grammability and complete nonvolatility fit well with 
data accumulation and recording needs. Electrical 
chip-erasure gives the designer a “blank slate” in 
which to log or record data. Data can be periodically 
off-loaded for analysis and the flash memory erased 
producing a new “blank slate’. 


A high degree of on-chip feature integration simpli- 
fies memory-to-processor interfacing. Figure 4 de- 
picts two 28F010s tied to the 80C186 system bus. 
The 28F010’s architecture minimizes interface cir-. 
cuitry needed for complete in-circuit updates of 
memory contents. 


The outstanding feature of the TSOP (Thin Small 
Outline Package) is the 1.2 mm thickness. With stan- 
dard and reverse pin configurations, TSOP reduces 
the number of board layers and overall volume nec- 
essary to layout multiple 28F010s. TSOP is particu- 
larly suited for portable equipment and applications 
requiring large amounts of flash memory. Figure 3 
illustrates the TSOP Serpentine layout. 


With cost-effective in-system reprogramming, ex- 
tended cycling capability, and true nonvolatility, 
the 28F010 offers advantages to the alternatives: 
EPROMs, EEPROMs, battery backed static RAM, 
or disk. EPROM-compatible read specifications, 
straight-forward interfacing, and in-circuit alterability 
offers designers unlimited flexibility to meet the high 
standards of today’s designs. 
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Figure 3. TSOP Serpentine Layout 
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Figure 4. 28F010 in a 80C 186 System 


PRINCIPLES OF OPERATION 


Flash-memory augments EPROM functionality with 
in-circuit electrical erasure and reprogramming. The 
28F010 introduces a command register to manage 
this new functionality. The command register allows 
for: 100% TTL-level control inputs; fixed power sup- 
plies during erasure and programming; and maxi- 
mum EPROM compatibility. 


In the absence of high voltage on the Vpp pin, the 
28F010 is a read-only memory. Manipulation of the 
external memory-control pins yields the standard 
EPROM read, standby, output disable, and Intelli- 
gent Identifier operations. 


The same EPROM read, standby, and output disable 
operations are available when high voltage is ap- 
plied to the Vpp pin. In addition, high voltage on Vpp 
enables erasure and programming of the device. All 
functions associated with altering memory con- 
tents—Intelligent Identifier, erase, erase verify, pro- 
gram, and program verify—are accessed via the 
command register. 


Commands are written to the register using standard 
microprocessor write timings. Register contents 
serve as input to an internal state-machine which 
controls the erase and programming circuitry. Write 
cycles also internally latch addresses and data 
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needed for programming or erase operations. With 
the appropriate command written to the register, 
standard microprocessor read timings output array 
data, access the Intelligent Identifier codes, or out- 
put data for erase and program verification. 


integrated Stop Timer 


Successive command write cycles define the dura- 
tions of program and erase operations; specifically, 
the program or erase time durations are normally 
terminated by associated program or erase verify 
commands. An integrated stop timer provides simpli- 
fied timing control over these operations; thus elimi- 
nating the need for maximum program/erase timing 
specifications. Programming and erase pulse dura- 
tions are minimums only. When the stop timer termi- 
nates a program or erase operation, the device en- 
ters an inactive state and remains inactive until re- 
ceiving the appropriate verify or reset command. 


Write Protection 


The command register is only active when Vpp is at 
high voltage. Depending upon the application, the 
system designer may choose to make the Vpp pow- 
er supply switchable—available only when memory 
updates are desired. When Vpp = Vpp,, the con- 
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Table 2. 28F010 Bus Operations 


Operation 


NOTES: 


Output Disable 
READ-ONLY | Standby 


Intelligent Identifier (Mfr) (2) 
Intelligent Identifier (Device) (2) 


READ/WRITE | Output Disable 
Standby‘) 


Vit 
: 


< 


< _ 
O |x| X<l¢ 


< 


9 


<|< 


1. Refer to DC Characteristics. When Vpp = Vpp, memory contents can be read but not written or erased. 
2. Manufacturer and device codes may also be accessed via a command register write sequence. Refer to Table 3. All other 


addresses low. 


3. Vip is the Intelligent Identifier high voltage. Refer to DC Characteristics. 
4. Read operations with Vpp = Vppy may access array data or the Intelligent Identifier codes. 
5. With Vpp at high voltage, the standby current equals Icc + Ipp (standby). 


6. Refer to Table 3 for valid Data-In during a write operation. 


7. X can be Vi_ or Vip. 


tents of the register default to the read command, 
making the 28F010 a read-only memory. In this 
mode, the memory contents cannot be altered. 


Or, the system designer may choose to ‘“hardwire’”’ 
Vpp, making the high voltage supply constantly 
available. In this case, all Command Register func- 
tions are inhibited whenever Vcc is below the write 
lockout voltage Vi Ko. (See Power Up/Down Protec- 
tion) The 28F010 is designed to accommodate ei- 
ther design practice, and to encourage optimization 
of the processor-memory interface. 


The two-step program/erase write sequence to the 
Command Register provides additional software 
write protections. 


BUS OPERATIONS 


Read 


The 28F010 has two control functions, both of which 
must be logically active, to obtain data at the out- 
puts. Chip-Enable (CE#) is the power control and 
should be used for device selection. Output-Enable 
(OE #) is the output control and should be used to 
gate data from the output pins, independent of de- 
vice selection. Refer to AC read timing waveforms. 


When Vpp is high (Vpp), the read operation can be 
used to access array data, to output the Intelligent 
Identifier codes, and to access data for program/ 


erase verification. When Vpp is low (Vpp;), the read 
operation can only access the array data. 


Output Disable 


With Output-Enable at a logic-high level (Vj}), output 
from the device is disabled. Output pins are placed 
in a high-impedance state. 


Standby 


With Chip-Enable at a logic-high level, the standby 
operation disables most of the 28F010’s circuitry 
and substantially reduces device power consump- 
tion. The outputs are placed in a high-impedance 
state, independent of the Output-Enable signal. 
If the 28F010 is deselected during erasure, pro- 
gramming, or program/erase verification, the 
device draws active current until the operation is 
terminated. 


Intelligent Identifier Operation 


The Intelligent Identifier operation outputs the manu- 
facturer code (89H) and device code (B4H). Pro- 
gramming equipment automatically matches the de- 
vice with its proper erase and programming algo- 
rithms. 
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With Chip-Enable and Output-Enable at a logic low 
level, raising AQ to high voltage Vip (see DC Charac- 
teristics) activates the operation. Data read from lo- 
cations OOOOH and 0001H represent the manufac- 
turer’s code and the device code, respectively. 


The manufacturer- and device-codes can also be 
read via the command register, for instances where 
the 28F010 is erased and reprogrammed in the tar- 
get system. Following a write of 90H to the com- 
mand register, a read from address location 0000H 
outputs the manufacturer code (89H). A read from 
address 0001H outputs the device code (B4H). 


Write 


Device erasure and programming are accomplished 
via the command register, when high voltage is ap- 
_ plied to the Vpp pin. The contents of the register 
serve as input to the internal state-machine. The 
state-machine outputs dictate the function of the 
device. 


The command register itself does not occupy an ad- 
dressable memory location. The register is a latch 
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used to store the command, along with address and 
data information needed to execute the command. 


The command register is written by bringing Write- 
Enable to a logic-low level (Vj), while Chip-Enable is 
low. Addresses are latched on the falling edge of 
Write-Enable, while data is latched on the rising 
edge of the Write-Enable pulse. Standard microproc- 
essor write timings are used. 


Refer to AC Write Characteristics and the Erase/ 
Programming Waveforms for specific timing 
parameters. 


COMMAND DEFINITIONS 


When low voltage is applied to the Vpp pin, the con- 
tents of the command register default to OOH, en- 
abling read-only operations. 


Placing high voltage on the Vpp pin enables read/ 
write operations. Device operations are selected by 
writing specific data patterns into the command reg- 
ister. Table 3 defines these 28F010 register 
commands. 


Table 3. Command Definitions 


Bus 
Cycles 
Req’d 


Read Memory 


Read Intelligent Identifier 
Codes(4) 


setup Eese/Ereeet) | 2 | wite 
ere 
wwe 


Program Verify(®) 


NOTES: 
1. Bus operations are defined in Table 2: 


First Bus Cycle Second Bus Cycie 


Operation(') | Address(2) | Data(3) | Operation(") | Address(2) | Data(3) 


[—wite [x [aon | wits [pa | PD 
reset” «| | wits | x | ren | wits | x | Few 


ae li 
al 
X__| 20H 


2. |A = Identifier address: OOH for manufacturer code, 01H for device code. 
EA = Address of memory location to be read during erase verify. 


PA = Address of memory location to be programmed. 


Addresses are latched on the falling edge of the Write-Enable pulse. 
3. ID = Data read from location IA during device identification (Mfr = 89H, Device = B4H). 


EVD = Data read from location EA during erase verify. 


PD = Data to be programmed at location PA. Data is latched on the rising edge of Write Enable. 
PVD = Data read from location PA during program verify. PA is latched on the Program command. 


. Figure 6 illustrates the Quick Erase Algorithm. 


NOOO 
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. Figure 5 illustrates the Quick Pulse Programming Algorithm. 
. The second bus cycle must be followed by the desired command register write. 


. Following the Read intgligent ID command, two read operations access manufacturer and device codes. 
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Read Command 


While Vpp is high, for erasure and programming, 
memory contents can be accessed via the read 
command. The read operation is initiated by writing 
OOH into the command register. Microprocessor 
read cycles retrieve array data. The device remains 
enabled for reads until the command register con- 
tents are altered. 


The default contents of the register upon Vpp pow- 
er-up is OOH. This default value ensures that no spu- 
rious alteration of memory contents occurs during 
the Vpp power transition. Where the Vpp supply is 
hard-wired to the 28F010, the device powers-up and 
remains enabled for reads until the command-regis- 
ter contents are changed. Refer to the AC Read 
Characteristics and Waveforms for specific timing 
parameters. 


Intelligent identifier Command 


Flash memories are intended for use in applications 
where the local CPU alters memory contents. As 
such, manufacturer- and device-codes must be ac- 
cessible while the device resides in the target sys- 
tem. PROM programmers typically access signature 
codes by raising A9 to a high voltage. However, mul- 
tiplexing high voltage onto address lines is not a de- 
sired system-design practice. 


The 28F010 contains an Intelligent Identifier opera- 
tion to supplement traditional PROM-programming 
methodology. The operation is initiated by writing 
90H into the command register. Following the com- 
mand write, a read cycle from address OOOOH re- 
trieves the manufacturer code of 89H. A read cycle 
from address 0001H returns the device code of 
B4H. To terminate the operation, it is necessary to 
write another valid command into the register. 


Set-up Erase/Erase Commands 


Set-up Erase is a command-only operation that 
stages the device for electrical erasure of all bytes in 
the array. The set-up erase operation is performed 
by writing 20H to the command register. 


To commence chip-erasure, the erase command 
(20H) must again be written to the register. The 
erase operation begins with the rising edge of the 
Write-Enable pulse and terminates with the rising 
edge of the next Write-Enable pulse (i.e., Erase-Veri- 
fy Command). 


This two-step sequence of set-up followed by execu- 
tion ensures that memory contents are not acciden- 
tally erased. Also, chip-erasure can only occur when 
high voltage is applied to the Vpp pin. In the absence 
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of this high voltage, memory contents are protected 
against erasure. Refer to AC Erase Characteristics 
and Waveforms for specific timing parameters. 


Erase-Verify Command 


The erase command erases all bytes of the array in 
parallel. After each erase operation, all bytes must 
be verified. The erase verify operation is initiated by 
writing AOH into the command register. The address 
for the byte to be verified must be supplied as it is 
latched on the falling edge of the Write-Enable 
pulse. The register write terminates the erase opera- 
tion with the rising edge of its Write-Enable pulse. 


The 28F010 applies an internally-generated margin 
voltage to the addressed byte. Reading FFH from 
the addressed byte indicates that all bits in the byte 
are erased. 


The erase-verify command must be written to the 
command register prior to each byte verification to 
latch its address. The process continues for each 
byte in the array until a byte does not return FFH 
data, or the last address is accessed. 


In the case where the data read is not FFH, another 
erase operation is performed. (Refer to Set-up 
Erase/Erase). Verification then resumes from the 
address of the last-verified byte. Once all bytes in 
the array have been verified, the erase step is com- 
plete. The device can be programmed. At this point, 
the verify operation is terminated by writing a valid 
command (e.g. Program Set-up) to the command 
register. Figure 6, the Quick Erase algorithm, illus- 
trates how commands and bus operations are com- 
bined to perform electrical erasure of the 28F010. 
Refer to AC Erase Characteristics and Waveforms 
for specific timing parameters. 


Set-up Program/Program Commands 


Set-up program is a command-only operation that 
stages the device for byte programming. Writing 40H 
into the command register performs the set-up 
operation. 


Once the program set-up operation is performed, 
the next Write-Enable pulse causes a transition to 
an active programming operation. Addresses are in- 
ternally latched on the falling edge of the Write-En- 
able pulse. Data is internally latched on the rising 
edge of the Write-Enable pulse. The rising edge of 
Write-Enable also begins the programming opera- 
tion. The programming operation terminates with the 
next rising edge of Write-Enable, used to write the 
program-verify command. Refer to AC Programming 
Characteristics and Waveforms for specific timing 
parameters. 
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Program-Verify Command 


The 28F010 is programmed on a byte-by-byte basis. 
Byte programming may occur sequentially or at ran- 
dom. Following each programming operation, the 
byte just programmed must be verified. 


The program-verify operation is initiated by writing 
COH into the command register. The register write 
terminates the programming operation with the ris- 
ing edge of its Write-Enable pulse. The program-ver- 
ify operation stages the device for verification of the 
byte last programmed. No new address information 
is latched. 


The 28F010 applies an internally-generated margin 
voltage to the byte. A microprocessor read cycle 
outputs the data. A successful comparison between 


the programmed byte and true data means that the. 


byte is successfully programmed. Programming then 
proceeds to the next desired byte location. Figure 5, 
the 28F010 Quick Pulse Programming algorithm, il- 
lustrates how commands are combined with bus op- 
erations to perform byte programming. Refer to AC 
Programming Characteristics and Waveforms for 
specific timing parameters. 


Reset Command 


A reset command is provided as a means to safely 
abort the erase- or program-command sequences. 
Following either set-up command (erase or program) 
with two consecutive writes of FFH will safely abort 
the operation. Memory contents will not be altered. 
A valid command must then be written to place the 
device in the desired state. 


EXTENDED ERASE/PROGRAM CYCLING 


EEPROM cycling failures have always concerned 
users. The high electrical field required by thin oxide 
EEPROMs for tunneling can literally tear apart the 
oxide at defect regions. To combat this, some sup- 
pliers have implemented redundancy schemes, re- 
ducing cycling failures to insignificant levels. Howev- 
er, redundancy requires that cell size be doubled— 
an expensive solution. 


Intel has designed extended cycling capability into 
its ETOX flash memory technology. Resulting im- 
provements in cycling reliability come without in- 
creasing memory cell size or complexity. First, an 
advanced tunnel oxide increases the charge carry- 
ing ability ten-fold. Second, the oxide area per cell 
subjected to the tunneling electric field is one-tenth 
that of common EEPROMs, minimizing the probabili- 
ty of oxide defects in the region. Finally, the peak 
electric field during erasure is approximately 
2 MV/cm lower than EEPROM. The lower electric 
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field greatly reduces oxide stress and the probability 
of failure—increasing time to wearout by a factor of 
100,000,000. 


The 28F010 is capable or 100,000 program/erase 
cycles. The device is programmed and erased using 
Intel’s Quick Pulse Programming and Quick Erase 
algorithms. Intel’s algorithmic approach uses a se- 
ries of operations (pulses), along with byte verifica- 
tion, to completely and reliably erase and program 
the device. 


For further information, see Reliability Report RR-60. 


QUICK PULSE PROGRAMMING ALGORITHM 


The Quick Pulse Programming algorithm uses pro- 
gramming operations of 10 ws duration. Each opera- 
tion is followed by a byte verification to determine 
when the addressed byte has been successfully pro- 
grammed. The algorithm allows for up to 25 pro- 
gramming operations per byte, although most bytes 
verify on the first or second operation. The entire 
sequence of programming and byte verification is 
performed with Vpp at high voltage. Figure 5 illus- 
trates the Quick Pulse Programming algorithm. 


QUICK ERASE ALGORITHM | 


Intel’s Quick Erase algorithm yields fast and reliable 
electrical erasure of memory contents. The algo- 
rithm employs a closed-loop flow, similar to the 
Quick Pulse Programming algorithm, to simulta- 
neously remove charge from all bits in the array. 


Erasure begins with a read of memory contents. The 
28F010 is erased when shipped from the factory. 
Reading FFH data from the device would immedi- 
ately be followed by device programming. 


For devices being erased and reprogrammed, uni- 
form and reliable erasure is ensured by first pro- 
gramming all bits in the device to their charged state 
(Data = OOH). This is accomplished, using the Quick 
Pulse Programming algorithm, in approximately two 
seconds. 


Erase execution then continues with an initial erase 
operation. Erase verification (data = FFH) begins at 
address 0000H and continues through the array to 
the last address, or until data other than FFH is en- 
countered. With each erase operation, an increasing 
number of bytes verify to the erased state. Erase 
efficiency may be improved by storing the address of 
the last byte verified in a register. Following the next 
erase operation, verification starts at that stored ad- 
dress location. Erasure typically occurs in one sec- 
ond. Figure 6 illustrates the Quick Erase algorithm. 
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(4) Start Bus Command 
Vppu 1] Standby | Wait for Vpp Ramp to Vppy(1) 


PLSCNT =0 


Initialize Pulse-Count 


WRITE Set-up ; 
Write Set-up Data = 40H 


Program 


, Write Program | Valid Address/Data 


Standby Duration of Program 
Operation (twHwH1) 


Write Program(2) | Data = COH; Stops Program 
: Verify Operation(3) 


Standby 'WHGL 


? 


Read Read Byte to Verify 


Programming 


Standby Compare Data Output to Data 
Expected 


Last 
Increment Address 
Address 2 


Y 
Write Data = OOH, Resets the 


Register for Read Operations 


Apply Apply : 
Programming 
Completed 


290207-5 
NOTES: 3. Refer to principles of operation. 
1. See DC Characteristics for the value of Vppy and 
VppL. 4. CAUTION: The algorithm MUST Be FOLLOWED 
> Program Verify is only performed after byte program- to ensure proper and reliable operation of the de- 
ming. A final read/compare may be performed (option- vice. 
al) after the register is written with the Read command. 


Figure 5. 28F010 Quick Pulse Programming Algorithm 
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Entire Memory Must = 00H 
Before Erasure 


Program All Use Quick Pulse 
Bytes to OOH Programming Algorithm 
(Figure 5) 
Apply Standby Wait for Vpp Ramp to Vppy(1) 
Vppu 1] 


ADDR = OOH ae 
PLSCNT = 0 Initialize Addresses and 


Pulse-Count 


ainda Write Data = 20H 


Write Write Data = 20H 


Erase Cmd 


Standby Duration of Erase Operation 
(twHWH2) 


Write Erase 


Verify Cmd Write Erase(2) Addr = Byte to Verify; 
Verify Data = AOH; Stops Erase 
Operation(s) 


Standby 'WHGL 


Read Data . 
Read Read Byte to Verify Erasure 


Inc 
ior eoontl Standby Compare Output to FFH 
Increment Pulse-Count 
Y 
. 
Address ? 
Y 


Write Rn 
Data = OOH, Resets the 


Register for Read Operations 


Apply Apply ; 
Vpp, [1] Vpp, [1] Wait for Vpp Ramp to Vpp, (1) 
Erasure 

Completed 
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1. See DC Characteristics for the value of Vppy and 3. Refer to principles of operation. 


VPPL- 
2. Erase Verify is performed only after chip-erasure. A 4. CAUTION: The algorithm MUST BE FOLLOWED 


the register is written with the read command. vice. 


Figure 6. 28F010 Quick Erase Algorithm 
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DESIGN CONSIDERATIONS 


Two-Line Output Control 


Flash-memories are often used in larger memory ar- 
rays. Intel provides two read-control inputs to ac- 
commodate multiple memory connections. Two-line 
control provides for: 


a. the lowest possible memory power dissipation 
and, 

b. complete assurance that output bus contention 
will not occur. 


To efficiently use these two control inputs, an ad- 
dress-decoder output should drive chip-enable, 
while the system’s read signal controls all flash- 
memories and other parallel memories. This assures 
that only enabled memory devices have active out- 
puts, while deselected devices maintain the low 
power standby condition. 


Power Supply Decoupling 


Flash-memory power-switching characteristics re- 
quire careful device decoupling. System designers 
are interested in three supply current (ioc) issues— 
standby, active, and transient current peaks pro- 
duced by falling and rising edges of chip-enable. The 
Capacitive and inductive loads on the device outputs 
determine the magnitudes of these peaks. 


Two-line control and proper decoupling capacitor 
selection will suppress transient voltage peaks. 
Each device should have a 0.1 wF ceramic capacitor 
connected between Vcc and Vss, and between Vpp 
and Vss. 


Place the high-frequency, low-inherent-inductance 
capacitors as close as possible to the devices. Also, 
for every eight devices, a 4.7 uF electrolytic capaci- 
tor should be placed at the array’s power supply 
connection, between Vcc and Vss. The bulk capaci- 
tor will overcome voltage slumps caused by printed- 


28F010 


Circuit-board trace inductance, and will supply 
charge to the smaller capacitors as needed. 


Vpp Trace on Printed Circuit Boards 


Programming flash-memories, while they reside in 
the target system, requires that the printed circuit 
board designer pay attention to the Vpp power sup- 
ply trace. The Vpp pin supplies the memory cell cur- 
rent for programming. Use similar trace widths and 
layout considerations given the Vcc power bus. Ad- 
equate Vpp supply traces and decoupling will de- 
crease Vpp voltage spikes and overshoots. 


Power Up/Down Protection 


The 28F010 is designed to offer protection against 
accidental erasure or programming during power 
transitions. Upon power-up, the 28F010 is indifferent 
as to which power supply, Vpp or Voc, powers up 
first. Power supply sequencing is not required. Inter- 
nal circuitry in the 28F010 ensures that the com- 
mand register is reset to the read mode on power 


up. 


A system designer must guard against active writes 
for Vcc voltages above Vi xo when Vpp is active. 
Since both WE# and CE# must be low for a com- 
mand write, driving either to Vjy will inhibit writes. 
The control register architecture provides an added 
level of protection since alteration of memory con- 
tents only occurs after successful completion of the 
two-step command sequences. 


28F010 Power Dissipation 


When designing portable systems, designers must 
consider battery power consumption not only during 
device operation, but also for data retention during 
system idle time. Flash nonvolatility increases the 
usable battery life of your system because the 
28F010 does not consume any power to retain code 
or data when the system is off. Table 4 illustrates the 
power dissipated when updating the 28F010. 


Table 4. 28F010 Typical Update Power Dissipation(¢) 


Power Dissipation 
(Watt-Seconds) 


Array Program/Program Verify 
Array Erase/Erase Verify 
One Complete Cycle 


NOTES: 

1. Formula to calculate typical Program/Program Verify Power = [Vpp xX 
# Bytes x typical # Prog Pulses (twHwHi X Ippo typical + twHaL X Ipp4 
typical)] + [Vcc <X # Bytes X typical # Prog Pulses (twHwuH1  Icco typical 
+ twHaL. = Ioca typical]. 

2. Formula to calculate typical Erase/Erase Verify Power = [Vpp (Vpp3 typical 
X terase typical + Ipps typical X twuaL < # Bytes)] + [Vcc (Icc3 typical x 
terase typical + Icocs typical X twHGL < # Bytes)]. 

3. One Complete Cycle = Array Preprogram + Array Erase + Program. 

4. “Typicals” are not guaranteed, but based on a limited number of samples 
from production lots. 
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ABSOLUTE MAXIMUM RATINGS* 


Operating Temperature 


*WARNING: Stressing the device beyond the “Absolute 


DURME TIGR oie 5 ud ap bees 0°C to + 70°C(1) Mavinain AEHEe Sua CHa oA nk Cae 
During Erase/Program ......... O°C to + 70°C") These are pelt eaas only. Gearsivon beyond the 

Operating Temperature , " “Operating Conditions’ is not recommended and ex- 
During Read ............... —40°C to + 85°C(2) tended exposure beyond the “Operating Conditions” 
During Erase/Program ...... — 40°C to + 85°C(2) may affect device reliability. 

Temperature Under Bias....... —10°C to +80°C(1) 

Temperature Under Bias....... —50°C to + 95°C(2) 

Storage Temperature .......... —65°C to + 125°C 

Voltage on Any Pin with 
Respect to Ground.......... —2.0V to + 7.0V(3) 

Voltage on Pin Ag with 
Respect to Ground....... —2.0V to + 13.5V(3; 4) 


Vpp Supply Voltage with 
Respect to Ground 


During Erase/Program....—2.0V to + 14.0V(S; 4) 
Vcc Supply Voltage with 

Respect to Ground.......... —2.0V to + 7.0V(8) 
Output Short Circuit Current............. 100 mA(5) 
NOTES: 


1. Operating Temperature is for commercial product as defined by this specification. 

2. Operating Temperature is for extended temperature products as defined by this specification. 

3. Minimum DC input voltage is —0.5V. During transitions, inputs may undershoot to —2.0V for periods less 
than 20 ns. Maximum DC voltage on output pins is Vcc + 0.5V, which may overshoot to Vcc + 2.0V for 
periods less than 20 ns. 

4. Maximum DC voltage on Ag or Vpp may overshoot to + 14.0V for periods less than 20 ns. 

5. Output shorted for no more than one second. No more than one output shorted at a time. 

6. See High Speed AC Input/Output reference Waveforms and High Speed AC Testing Load Circuits for 
testing characteristics. 

7. See AC Input/Output reference Waveforms and AC Testing Load Circuits for testing characteristics. 


OPERATING CONDITIONS 


“5 


Operating Temperature Ce a 
Operating Temperature Soe Se 


Voc Supply Voltage (10%) ae: goa 
Voc Supply Voltage (5%) 


Limits 
Test Conditions 
sembot Notes | Typical(4) Fao] Unt] —_Testconctons 
Input Leakage Current 


£10 Voc = Vcc Max 
. | Vin = Voc or Vss 


Output Leakage Current 
Voc Standby Current 
Vcc Active Read Current 


Vout = Vcc or Vss 

12 Voc = Voc Max 
CE# = Vin 

Bd er 


f = 6 MHz, lout = OMA 
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~ DC CHARACTERISTICS—TTL/NMOS COMPATIBLE—Commercial Products 
(Continued) : 


Limits . 
Parameter es come Test Conditions 
Symbol Parameter, (Note Typical()/ Max | 


icce [Veo Programming Curent [1.2 | 10 | 10 |mA|Programmingin Progress 
loco \VocErase Curent | 1.2| | 50 | 15 |malErasurein Progress 


loc4 Voc Program Verify Current Le 15 MA |Vpp = Vppp, Program 
Verify in Progress 
locs Voc Erase Verify Current 2 1S mA |Vpp = Vppp, Erase 
Verify in Progress 
pps + 


Vpp Leakage Current +10 
or Standby Current mets +100 


Vpp Programming Current 1,2 mA |Vpp = Vppy 
| Programming in Progress 
Vpp Erase Current ) mA |Vpp = Vppy 
Erasure in Progress 
Vpp Program Verify Current 2 mA |Vpp = Vppp, Program 
Verify in Progress 
Vpp Erase Verify Current 1,2 mA |Vpp = Vppp, Erase 
Verify in Progress 
input Low Voltage aS a ae ae ee 
input High Voltage [feof [voc +05] v_ 


Output Low Voltage 0.45 V jlo, = 5.8 mA 
Voc = Vcc Min 

Output High Voltage V jlon = —2.5mA 
Voc = Vcc Min 


Ag Intelligent Identifer Voltage 
Ag Intelligent Identifier Current 


Vpp_ | Vpp during Read-Only V_ |NOTE: Erase/Program are 
Operations Inhibited when Vpp = Vpp, 


U 
BS 


V 
V 


O 


Kg 


i 
fe) 
= 


IL 

IH 
3 

D 


wk 
= 
oO 
i=) 
ali 
Gd 
oO 
(o) 
< 


ppyH |Vpp during Read/Write 
Operations 


Voc Erase/Write Lock Voltage a 


- 
A 
O 


Parameter Notes ake Test Conditions 
| Min Typical(4) 
Input Leakage Current £1.0 Voc = Vcc Max 
Vin = Voc or Vss 
Output Leakage Current 1s Fae Voc = Voc Max 


lu 
ILo 


Vout = VecorVss 
-locs Voc Standby Current 100 | pA | Voc = Voc Max 
CE# = Vcc +0.2V 
loc Vcc Active Read Current i eae 


Voc = Vcc Max, CE# = Vi, 
f 
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DC CHARACTERISTICS—CMOS COMPATIBLE—Commercial Products (Continued) 


Parameter Notes lini Test Conditions 
— Typical] Max | 


reg maya ea Programming Current 40 | 10 | mA Programming in Progress 


jas fies Program Verify NeotemeOmert _| et 1,2 15 Vpp = Vppy, Program 
Verify in Progress 
locs Voc Erase Verify Current 1,2 mA | Vpp = Vppy, Erase 
Verify in Progress 
‘pps _| Vpp Leakage Current cs eae Min ears Vpp < Vcc 
Vee Read Current, ID was eae ik eee 


Current or Standby Current a. to | Vpp < Voc 


Vpp Programming ya mA | Vpp = VppyH 
Current Programming in Progress 
Vpp Erase Current 1,2 mA | Vpp = VppH 

. Erasure in Progress 
Vpp Program Verify mA | Vpp = Vppp, Program 
Current Verify in Progress 
Vpp Erase Verify mA | Vpp = Vppy, Erase 
ee Verify in Progress 

oe [Input High Voltage fetiiese [Tore et 


Output Low Voltage 0.45 lo. = 5.8 mA 
sears = Vcc Min 
Vout _| 0. | 0.85 Voc | V lon = —2.5mA, Voc = 
an SMCS ee High Voltage ern ad iad 2.8 pose ee ee tect doh 
one _| Voc — 0.4 | 0.4 lon = —100 loH = —100 HA, Voc = Voc Min Voc = Vcc Min 
Ag Intelligent Identifer 11.50 13.00 
Voltage 
Ag Intelligent Identifier y2 BA | Ag = Vip 
Current 
VpPL Vpp during Read-Only V_ | NOTE: Erase/Programs are 
Operations Inhibited when Vpp = Vpp,_ 
VpPH Vpp during Read/Write 11.40 12.60 V 
Operations 
VLKO Voc Erase/Write Lock V 
Voltage 
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- As ese liek SARS sid. Seay COMPATIBLE—Extended Temperature 
roducts 


eee ie pits PAM 
aoe = Vcc or Vss 
“Wour = Vcc or Vss 
= fave [7 se 


CE# = Vin 
Voc = Voc Max, CE# = Vi, 
CC2 Voc Programming Current 
CC3 Voc Erase Current 


f = 6 MHz, lout = OmA 
CC4 Voc Program Verify Current 
CC5 Voc Erase Verify Current Lie 


Vpp Leakage Current 
lpp1 _|Vpp Read Current 1 

or Standby Current 
Vpp Programming Current » 
Vpp Erase Current 1:2 
Ipp4 Vpp Program Verify Current 1,2 
Vpp Erase Verify Current 1,2 


Input Low Voltage 
Input High Voltage 


tea 
hae 
fener 
ae 


oO 


A |Programming in Progress 


A |Erasure in Progress 


> 


mA |Vpp = Vppp, Program 


Verify in Progress 


Vpp = Vppp, Erase 
Verify in Progress 


pp < Vcc 
Vpp > Vcc 
pp < Vcc 


Vpp = VpPH 
Programming in Hi ht 


H 
° 
= 


= Ss E/E 3 = = = 
ae alah eee : seal ae aLata 


1 
= 


Vpp = VpPH 
Erasure in Progress 


Vpp = Vppy, Program 
Verify in Progress 


Vpp = Vppy, Erase 
Verify in Progress 


lo. = 5.8mA 
Voc = Vcc Min 


lon = —2.5mA 
Voc = Vcc Min 


co ak 
oO . 


VonHi |Output High Voltage 


ppL |Vpp during Read- Only 
Operations 

ppH |Vpp during Read/Write 11.40 
Operations 


Voc Erase/Write Lock Voltage 


NOTE: Erase/Program are 
Inhibited when Vpp = Vpp, 


) 
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DC CHARACTERISTICS—CMOS COMPATIBLE—Extended Temperature 
Products | 


| Limits sa 
Parameter Notes Test Conditions 

ea ae an Typical(4) I st Mia esa 
ly Input Leakage 1 +1.0 | wAlVcc = Voc Max 

Current Vin = Voc or Vss 
ILo Output Leakage +10 BWA |\Vcc = Voc Max 

Current Vout = Voc or Vss 
Voc Standby BA |\Voc = Voc Max 
Current CE# = Vcc +0.2V 


loc1 Voc Active Read mA |Vcc = Voc Max, CE# = Vi. 
Current 
Vpp Leakage Current 
Vpp Erase Current 1,2 
Input High Voltage 


f = 10 MHz, lout = OmA 
lcce Voc Programming ey Ie 
Current 
Vpp Read Current, 
Vpp Program Verify "Eiae 
Output Low Voltage sae Sie 


Programming | in Progress 


Erasure in Progress 
MA |Vpp = Vppp, Program 
Verify in Progress 
mA |Vpp = Vppy, Erase 
Verify in Progress 
A | Vpp S Vcc 


LA |Vpp > Voc 
Vpp < Voc 


aise: 

| +10 | 

Risak 

ae 
Programming in Progress 

ae FY 


mA |Vpp = VpPH 
Erasure in Progress 

mA | Vpp = Vppp, Program 
Verify in Progress 

mA |Vpp = Vppy, Erase 
Verify in Progress 


Voc Program Verify 
Current 
locs Voc Erase Verify 

Current 

1 

Standby Current 

Vpp Programming 

Current 

Vpp Erase Verify 

Current 

Input Low Voltage 


< 


V 


ID Current or 
Current 
Output High Voltage 


V 
VOH1 
V 


lon = —100 pA, 
Voc = Vcc Min 


13.00 


VoH2 


lon = —2.5 mA, 
Voc = Vcc Min 


Ag Intelligent Identifer 
Voltage 

Ag Intelligent Identifier} 1,2 

Current 


2) 2) 
ra) 0) 
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DC CHARACTERISTICS—CMOS COMPATIBLE—Extended Temperature 


Products (Continued) 
Parameter Test Conditions 
| Min | Typical) | Max 
Vpp during Read-Only V_ | NOTE: Erase/Programs are 
Operations Inhibited when Vpp = Vpp, 
VpPH Vpp during Read/Write 11.40 1Zs0y Vv 
Operations 
VLKO Vcc Erase/Write Lock V 
Voltage 


ec 
Twin [wax 
Ton | Addtoss/Contaiapaciancs [2 | | a 
see) 


CouT _ . Output Capacitance 
1. All currents are in RMS unless otherwise noted. Typical values at Voc = 5.0V, Vpp = 12.0V, T = 25°C. These currents 


NOTES: 

are valid for all product versions (packages and speeds). 

2. Not 100% tested: characterization data available. 

3. Sampled, not 100% tested. 

4. “‘Typicals” are not guaranteed, but based on a limited number of samples from production lots. 


2.5 


Conditions 
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AC TESTING INPUT/OUTPUT 
WAVEFORM(1) | 


2.4 
2.0 TEST 2.0 
ae INPUT 0.8 POINTS x 0.8 OUTPUT 


290207-7 


AC test inputs are driven at Von (2.4 Vr t_) for a Logic 
“1” and Vo, (0.45 Vrt_) for a Logic “0”. Input timing 
begins at Viy (2.0 Vrz_) and Vi, (0.8 Vt7_). Output tim- 
ing ends at Vij and Vj,. Input rise and fall times (10% 
to 90%) <10 ns. 


AC TESTING LOAD CIRCUIT(1) 


DEVICE 


UNDER 
TEST 


CL. = 100 pF 
C. includes Jig Capacitance 
R, = 3.3 KN 
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AC TEST CONDITIONS(1) 


Input Rise and Fall Times (10% to 90%)...... 10 ns 
Input Pulse Levels ................ 0.45V and 2.4V 
Input Timing Reference Level ....... 0.8V and 2.0V 
Output Timing Reference Level ...... 0.8V and 2.0V 
LGC LOU: oss 5 eecaaves nena canes once 100 pF 
NOTES: 7 
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HIGH SPEED AC TESTING INPUT/OUTPUT 
WAVEFORM(2) 


3.0 
INPUT >€ 1.5 -— TEST POINTS — >€1.5 OUTPUT 
0.0 


290207-8 


AC test inputs are driven at 3.0V for a Logic “1” and 
0.0V for a Logic “O”. Input timing begins, and output 
timing ends, at 1.5V. Input rise and fall times (10% to 
90%) <10 ns. 


' 


HIGH SPEED AC TESTING LOAD CIRCUIT(2) 


DEVICE 
UNDER 
TEST 


CL = 30 pF 
Cy. includes Jig Capacitance 
Ry = 3.3 KN 
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HIGH-SPEED AC TEST CONDITIONS(2) 


Input Rise and Fall Times (10% to 90%)...... 10 ns 
Input Pulse LOVOlS «i... aves. ven nees 0.0V and 3.0V 
Input Timing Reference Level................ 1.5V 
Output Timing Reference Level .............. 1.5V 
Capacitive Load......... fp hehed Can ae ase cae 30 pF 


1. Testing characteristics-for 28F010-65 in standard configuration, and 28F010-90, 28F010-120, and 28F010-150. 
2. Testing characteristics for 28F010-65 in high speed configuration. 
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Versions 


tavav/tacc | Address Access Time 


Chip Disable to Output 
in High Z 

teLax/toLz | Output Enable to Output 
in Low Z 


Output Disable to Output 
in High Z 


NOTES: 

1. Whichever occurs first. 

2. Sampled, not 100% tested. 

3. Guaranteed by design. 

4. See High Speed AC Input/Output reference Waveforms and High Speed AC Testing Load Circuits for testing characteristics. 
5. See AC Input/Output reference Waveforms and AC Testing Load Circuits for testing characteristics. 


Ss]ONpoOlidg sunjesodwe_ 
—SOILSIHSALOVYVHO OV 


neisdo AjuQ peay 


N 


paepuse}xq pue jelouaww0j—suo 
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vVS-S 


suo}eiedo peey 10} SULIOJOABM OY *Z e4NnBi4 


ADDRESSES 


CE# (E#) 


OE# (G#) 


WE# (W#) 


DATA (DO) 


DEVICE AND 


OOo RQ 


tavav (tec) 


‘tine ‘ia laa teHz 
a tcHaz 
(tor) 


terov (tog) 
teLov (toe) 


terax (torz) >] 
trax (tz) 


ee tavav (tacc) 
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tou 


VALID sth eae WAN HIGH Z 
[ELLY 


010482 


_ GSS 


a a ee Oh eee 
28F010-65(5) 28F010-90(5) | 28F010-120(5) | 28F010-150(5) 


Vcc + 5% 
Vcc + 10% 


Versions 


Characteristic Notes 


Write Cycle Time 
Address Set-Up Time 


at 
Oo 
oO 


tavav/two 
tavwi/tas 


twLax/taH Address Hold Time 40 

tovwH/tps Data Set-Up Time 

twHpx/tpH Data Hold Time 1 

tWHGL Write Recovery Time ys 
before Read 

tGHWL Read Recovery Time 
before Write 

teLwL/tcs Chip Enable Set-Up Time 
before Write 


Chip Enable Hold Time 
Write Pulse Width 


tWHEH/tcH 
twLwH/twe 


twHwL/tweH | Write Pulse Width High 


sjONpoijg sinyeiedwie) pepus}xy pue jeissaWwWw0ED 


—()suopesedo AjuQ wei6O1d/eSe139/2}JM—SOILSIUSLOVUVHO OV 


ah 


oh S = 


Duration of Programming 
Operation 


a 


” 


Duration of Erase 
Operation 


”n 


Vpp Set-Up Time to 
Chip Enable Low 


tVPEL 


NOTES: 

1. Read timing characteristics during read/write operations are the same as during read-only operations. Refer to AC Characteristics for Read-Only Operations. 
2. Guaranteed by design. 

3. The integrated stop timer terminates the programming/erase operations, thus eliminating the need for a maximum specification. 

4. See High Speed AC Input/Output reference Waveforms and High Speed AC Testing Load Circuits for testing characteristics. 

5. See AC Input/Output reference Waveforms and AC Testing Load Circuits for testing characteristics. 

6. Minimum specification for Extended Temperature product. 
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CUM . PROB . 
EERE TE SE: Fie 


. 


Chip Program Time (Sec) 
ay 10 ke; 23C 
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BERSRERA IEEE Y 


HERE RS AEREA 
{| te ee 
age 


CHIP PROGRAM TIME SEC 


aan unra 
ALU YEALL 
[ca ec ee 


ane a ee ee ee 
10 20 WD 4 530 &O 70 8 9 100 110 120 130 
TEMP (C) 
ome 1k Cycles 
--=-- 10k Cycles 


100k Cycles 
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Figure 9. Typical Program Time at 12V 
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Figure 11. Typical Erase Time at 12V 
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Vcc + 5% 
Vcc + 10% 


Versions 


Characteristic 


Write Cycle Time 
Address Set-Up Time 


Address Hold Time 
Data Set-Up Time 


Data Hold Time 
tEHGL Write Recovery Time 
| before Read 
tGHWL Read Recovery Time 
before Write 
tWLEL Write Enable Set-Up Time 
before Chip Enable 
Write Enable Hold Time 


Write Pulse Width 


Write Pulse Width High 
tEHEH1 Duration of Programming 
Operation 
tEHEH2 | Duration of Erase 
Operation 
tvPEL Vpp Set-Up Time to Chip 
Enable Low 


NOTE: 
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1. Read timing characteristics during read/write operations are the same as during read-only operations. Refer to AC Characteristics for Read-Only Operations. 
2. Guaranteed by design. 

3. The integrated stop timer terminates the programming/erase operations, thus eliminating the need for a maximum specification. 

4. See High Speed AC Input/Output reference Waveforms and High Speed AC Testing Load Circuits for testing characteristics. 

5. See AC Input/Output reference Waveforms and AC Testing Load Circuits for testing characteristics. 

6. Minimum specification for Extended Temperature product. 
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® 

ERASE AND PROGRAMMING PERFORMANCE 


Parameter Typical | Max | Unit 
Chip Erase Time SS es WE a 


NOTES: 

1. “Typicals” are not guaranteed, but based on samples from production lots. Data taken at 25°C, 12.0V Vpp. 

2. Minimum byte programming time excluding system overhead is 16 usec (10 wsec program + 6 psec write recovery), 
while maximum is 400 ysec/byte (16 psec x 25 loops allowed by algorithm). Max chip programming time is specified lower 
than the worst case allowed by the programming algorithm since most bytes program significantly faster than the worst case 
byte. 

3. Excludes 00H programming prior to erasure. 

4. Excludes system level overhead. 
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ORDERING INFORMATION 


Tlefzfe{rfof fo[-[+[2fo| 
TEMPERATURE Poot eae PACKAGE | 
ACCESS SPEED (ns) 


T = EXTENDED (-40°C to +85°C) P = 32-PIN PLASTIC DIP 
BLANK = COMMERCIAL (0°C to +70°C) N = 32-LEAD PLCC 120 ns 
E = STANDARD 32-LEAD TSOP 150 ns 


F = REVERSE 32-LEAD TSOP 
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VALID COMBINATIONS: 

P28F010-65 N28F010-65 TN28F010-90 
P28F010-90 N28F010-90 

P28F010-120 N28F010-120 

P28F010-150 N28F010-150 


E28F010-65 F28F010-65 TE28F010-90 
E28F010-90 F28F010-90 TF28F010-90 
E28F010-120 F28F010-120 
E28F010-150 F28F010-150 


ADDITIONAL INFORMATION ! 


Order 
Number 

ER-20, “ETOX Flash Memory 294005 
Technology” 

ER-24, “Intel Flash Memory” 294008 

ER-28, “ETOX Ill Flash Memory 294012 
Technology” 

RR-60, “ETOX Flash Memory 293002 
Reliability Data Summary” 

AP-316, “Using Flash Memory for 292046 
In-System 


Reprogrammable 
Nonvolatile Storage” 


AP-325 “Guide to Flash Memory 292059 
Reprogramming’”’ 


REVISION HISTORY 


Removed 200 ns Speed Bin 
Revised Erase Maximum Pulse Count for Figure 5 from 3000 to 1000 
Clarified AC and DC Test Conditions 

Added ‘‘dimple”’ to F TSOP Package 

Corrected Serpentine Layout 


Corrected AC Waveforms 
Added Extended Temperature Options 


Added 28F010-65 and 28F010-90 speeds 
Revised Symbols, i.e., CE, OE, etc. to CE#, OE#, etc. 
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28F512 
512K (64K x 8) CMOS FLASH MEMORY 
mw Flash Electrical Chip-Erase m= Command Register Architecture for 
— 1 Second Typical Chip-Erase Microprocessor/Microcontroller 
m Quick-Pulse Programming Algorithm Compatible Write Interface 
— 10 us Typical Byte-Program = Noise Immunity Features 
— 1 Second Chip-Program — +10% Vcc Tolerance 


— Maximum Latch-Up Immunity 
through EP! Processing 


m ETOX Il Nonvolatile Flash Technology 


m@ 100,000 Erase/Program Cycles 
m 12.0V +5% Vpp 


m High-Performance Read — EPROM-Compatible Process Base 
— 120 ns Maximum Access Time aves High-Volume Manufacturing 
m CMOS Low Power Consumption Experience 
— 10 mA Typical Active Current gw JEDEC-Standard Pinouts 
— 50 A Typical Standby Current — 32-Pin Plastic Dip 
— OW Data Retention Power — 32-Lead PLCC 


(See Packaging Spec., Order #231369) 
= Extended Temperature Options 


m Integrated Program/Erase Stop Timers 


Intel’s 28F512 CMOS flash memory offers the most cost-effective and reliable alternative for read/write 
random access nonvolatile memory. The 28F512 adds electrical chip-erasure and reprogramming to familiar 
EPROM technology. Memory contents can be rewritten: in a test socket; in a PROM-programmer socket; on- 
board during subassembly test; in-system during final test; and in-system after-sale. The 28F512 increases 
memory flexibility, while contributing to time- and cost-savings. 


The 28F512 is a 512-kilobit nonvolatile memory organized as 65,536 bytes of 8 bits. Intel’s 28F512 is offered 
in 32-pin plastic dip or 32-lead PLCC packages. Pin assignments conform to JEDEC standards for byte-wide 
EPROMs. 


Extended erase and program cycling capability is designed into Intel’s ETOX II (EPROM Tunnel Oxide) pro- 
cess technology. Advanced oxide processing, an optimized tunneling structure, and lower electric field com- 
bine to extend reliable cycling beyond that of traditional EEPROMs. With the 12.0V Vpp supply, the 28F512 
performs 100,000 erase and program cycles well within the time limits of the Quick-Pulse Programming and 
Quick-Erase algorithms. 


Intel’s 28F512 employs advanced CMOS circuitry for systems requiring high-performance access speeds, low 
power consumption, and immunity to noise. Its 120 nanosecond access time provides no-WAIT-state perform- 
ance for a wide range of microprocessors and microcontrollers. Maximum standby current of 100 A trans- 
lates into power savings when the device is deselected. Finally, the highest degree of latch-up protection is 
achieved through Intel’s unique EPI processing. Prevention of latch-up is provided for stresses up to 100 mA 
on address and data pins, from —1V to Vcc + 1V. 


With Intel’s ETOX II process base, the 28F512 levers years of EPROM experience to yield the highest levels of 
quality, reliability, and cost-effectiveness. 
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Figure 1. 28F512 Block Diagram 
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Figure 2. 28F512 Pin Configurations 


Table 1. Pin Description 


| Symbol | Type Name and Function 


lacie Ais feet ADDRESS INPUTS for memory addresses. Addresses are internally 
latched during a write cycle. 
nc DQ7 | INPUT/ Fetal DATA INPUT/OUTPUT: Inputs data during memory write cycles; 
outputs data during memory read cycles. The data pins are active high 
and float to tri-state OFF when the chip is deselected or the outputs 
are disabled. Data is internally latched during a write cycle. 
INPUT 
deselects the memory device and reduces power consumption to 
standby levels. 
INPUT OUTPUT ENABLE: Gates the devices output through the data buffers 
during a read cycle. OE # is active low. 
WRITE ENABLE: Controls writes to the control register and the array. 
Write enable is active low. Addresses are latched on the falling edge 
and data is latched on the rising edge of the WE # pulse. 


Note: With Vpp < 6.5V, memory contents cannot be altered. 
Vpp ERASE/PROGRAM POWER SUPPLY for writing the command 
register, erasing the entire array, or programming bytes in the array. 


/Vcc ~=—s«d | SSSs*~*éstsSSsSs DEVICE POWER SUPPLY (5V + 10%) 


oe ae ae ee we ee 
eee NO INTERNAL CONNECTION to device. Pin may be driven or left 
floating. 


CHIP ENABLE: Activates the device’s control logic, input buffers, 
decoders and sense amplifiers. CE # is active low; CE # high 
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APPLICATIONS 


The 28F512 flash memory provides nonvolatility 
along with the capability to perform over 100,000 
electrical chip-erasure/reprogram cycles. These fea- 
tures make the 28F512 an innovative alternative to 
disk, EEPROM, and battery-backed static RAM. 
Where periodic updates of code and data-tables are 
required, the 28F512’s reprogrammability and non- 
volatility make it the obvious and ideal replacement 
for EPROM. 


Primary applications and operating systems stored 
in flash eliminate the slow disk-to-DRAM download 
process. This results in dramatic enhancement of 
performance and substantial reduction of power 
consumption — a consideration particularly impor- 
tant in portable equipment. Flash memory increases 
flexibility with electrical chip erasure and in-system 
update capability of operating systems and applica- 
tion code. With updatable BIOS, system manufactur- 
ers can easily accommodate last-minute changes as 
revisions are made. 


In diskless workstations and terminals, network traf- 
fic reduces to a minimum and systems are instant- 
on. Reliability exceeds that of electromechanical 
media. Often in these environments, power interrup- 
tions force extended re-boot periods for all net- 
worked terminals. This mishap is no longer an issue 
if boot code, operating systems, communication pro- 
tocols and primary applications are flash-resident in 
each terminal. 


For embedded systems that rely on dynamic RAM/ 
disk for main system memory or nonvolatile backup 
storage, the 28F512 flash memory offers a solid 
state alternative in a minimal form factor. The 
28F512 provides higher performance, lower power 
consumption, instant-on capability, and allows an 
“execute in place’ memory hierarchy for code and 
data table reading. Additionally, the flash memory is 
more rugged and reliable in harsh environments 
where extreme temperatures and shock can cause 
disk-based systems to fail. 


The need for code updates pervades all phases of a 
system’s life — from prototyping to system manufac- 
ture to after-sale service. The electrical chip-erasure 
and reprogramming ability of the 28F512 allows in- 
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circuit alterability; this eliminates unnecessary han- 
dling and less-reliable socketed connections, while 
adding greater test, manufacture, and update flexi- 
bility. 


Material and labor costs associated with code 
changes increases at higher levels of system inte- 
gration — the most costly being code updates after 
sale. Code “bugs”, or the desire to augment system 
functionality, prompt after-sale code updates. Field 
revisions to EPROM-based code requires the re- 
moval of EPROM components or entire boards. With 
the 28F512, code updates are implemented locally 
via an edge-connector, or remotely over a commun- 
cation link. 


For systems currently using a high-density static 
RAM/battery configuration for data accumulation, 
flash memory’s inherent nonvolatility eliminates the 
need for battery backup. The concern for battery 
failure no longer exists, an important consideration 
for portable equipment and medical instruments, 
both requiring continuous performance. In addition, 
flash memory offers a considerable cost advantage 
over static RAM. 


Flash memory’s electrical chip erasure, byte pro- 
grammability and complete nonvolatility fit well with 
data accumulation and recording needs. Electrical 
chip-erasure gives the designer a “blank slate” in 
which to log or record data. Data can be periodically 
off-loaded for analysis and the flash memory erased 
producing a new “blank slate’. 


A high degree of on-chip feature integration simpli- 
fies memory-to-processor interfacing. Figure 3 de- 
picts two 28F512s tied to the 80C186 system bus. 
The 28F512’s architecture minimizes interface cir- 
Cuitry needed for complete in-circuit updates of 
memory contents. 


With cost-effective in-system reprogramming, ex- 
tended cycling capability, and true nonvolatility, 
the 28F512 offers advantages to the alternatives: 
EPROMs, EEPROMs, battery backed static RAM, 
or disk. EPROM-compatible read specifications, 
straight-forward interfacing, and in-circuit alterability 
offers designers unlimited flexibility to meet the high 
standards of today’s designs. 
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Figure 3. 28F512 in a 80C 186 System 


PRINCIPLES OF OPERATION 


Flash-memory augments EPROM functionality with 
in-circuit electrical erasure and reprogramming. The 
28F512 introduces a command register to manage 
this new functionality. The command register allows 
for: 100% TTL-level control inputs; fixed power sup- 
plies during erasure and: programming; and maxi- 
mum EPROM compatibility. 


In the absence of high voltage on the Vpp pin, the 
28F512 is a read-only memory. Manipulation of the 
external memory-control pins yields the standard 
EPROM read, standby, output disable, and Intelli- 
gent Identifier operations. 


The same EPROM read, standby, and output disable 
operations are available when high voltage is ap- 
plied to the Vpp pin. In addition, high voltage on Vpp 
enables erasure and programming of the device. All 
functions associated with altering memory con- 
tents—Intelligent Identifier, erase, erase verify, pro- 
gram, and program verify—are accessed via the 
command register. 


Commands are written to the register using standard 
microprocessor write timings. Register contents 
serve as input to an internal state-machine which 
controls the erase and programming circuitry. Write 
cycles also internally latch addresses and data 
needed for programming or erase operations. With 
the appropriate command written to the register, 
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standard microprocessor read timings output array 
data, access the Intelligent Identifier codes, or out- 
put data for erase and program verification. 


Integrated Stop Timer 


Successive command write cycles define the dura- 
tion of program and erase operations; specifically, 
the program or erase time durations are normally 
terminated by associated program or erase verify 
commands. An integrated stop timer provides simpli- 
fied timing control over these operations; thus elimi- 
nating the need for maximum program/erase timing 
specifications. Programming and erase pulse 
durations are minimums only. When the stop timer 
terminates a program or erase operation, the device 
enters an inactive state and remains inactive until 
receiving the appropriate verify or reset command. 


Write Protection 


The command register is only active when Vpp is at 
high voltage. Depending upon the application, the 
system designer may choose to make the Vpp pow- 
er supply switchable—available only when memory 
updates are desired. When Vpp = Vpp,, the con- 
tents of the register default to the read command, 
making the 28F512 a read-only memory. In this 
mode, the memory contents cannot be altered. 


. 28F512 


Table 2. 28F512 Bus Operations 


Read 


Write 


NOTES: 


CE# | OE# | WE# | DQo-DQ7 


ViH /DataOut Out 
READ-ONLY 
ncap/warre [OubputDicebio | Veen | x | Xx | Vu 

Pstandty i Vo xx | ve | x |x [Teste 
[Write | Ve | Ao | Ao | Yu | Vin | Vn [Data in) | 


xX ViL 


1. Refer to DC Characteristics. When Vpp = Vpp, memory contents can be read but not written or erased. 
2. Manufacturer and device codes may also be accessed via a command register write sequence. Refer to Table 3. All other 


addresses low. 


3. Vip is the Intelligent Identifier high voltage. Refer to DC Characteristics. 
4. Read operations with Vpp = Vppy may access array data or the Intelligent Identifier codes. 
5. With Vpp at high voltage, the standby current equals Icc + Ipp (standby). 


6. Refer to Table 3 for valid Data-In during a write operation. 


7. X can be Vi, or Vip. 


Or, the system designer may choose to “hardwire” 
Vpp, making the high voltage supply constantly 
available. In this case, all Command Register func- 
tions are inhibited whenever Vcc is below the write 
lockout voltage V; xo. (See Power Up/Down Protec- 
tion). The 28F512 is designed to accommodate eéi- 
ther design practice, and to encourage optimization 
of the processor-memory interface. 


The two-step program/erase write sequence to the 
Command Register provides additional software 
write protection. 


BUS OPERATIONS 


Read 


The 28F512 has two control functions, both of which 
must be logically active, to obtain data at the out- 
puts. Chip-Enable (CE#) is the power control and 
should be used for device selection. Output-Enable 
(OE#) is the output control and should be used 
to gate data from the output pins, independent of 
device selection. Refer to AC read _ timing 
waveforms. 


When Vpp is high (Vppy), the read operation can be 
used to access array data, to output the Intelligent 
Identifier codes, and to access data for program/ 
erase verification. When Vpp is low (Vpp,), the read 
operation can only access the array data. 


Output Disable 


With Output-Enable at a logic-high level (Vj), output 
from the device is disabled. Output pins are placed 
in a high-impedance state. 


Standby 


With Chip-Enable at a logic-high level, the standby 
operation disables most of the 28F512’s circuitry 
and substantially reduces device power consump- 
tion. The outputs are placed in a high-impedance 
state, independent of the Output-Enable signal. 
lf the 28F512 is deselected during erasure, pro- 
gramming, or program/erase verification, the 
device draws active current until the operation is 
terminated. 


Intelligent Identifier Operation 


The Intelligent Identifier operation outputs the manu- 
facturer code (89H) and device code (B8H). Pro- 
gramming equipment automatically matches the de- 
vice with its proper erase and programming algo- 
rithms. 
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With Chip-Enable and Output-Enable at a logic low 
level, raising AQ to high voltage Vip (see DC Charac- 
teristics) activates the operation. Data read from lo- 
cations OOOOH and O001H represent the manufac- 
turer’s code and the device code, respectively. 


The manufacturer- and device-codes can also be 
read via the command register, for instances where 
the 28F512 is erased and reprogrammed in the tar- 
get system. Following a write of 90H to the com- 
mand register, a read from address location OOOOH 
Outputs the manufacturer code (89H). A read from 
address 0001H outputs the device code (B8h). 


Write 


Device erasure and programming are accomplished 
via the command register, when high voltage is ap- 
plied to the Vpp pin. The contents of the register 
serve as input to the internal state-machine. The 
state-machine outputs dictate the function of the 
device. 


The command register itself does not occupy an ad- 
dressable memory location. The register is a latch 
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used to store the command, along with address and 
data information needed to execute the command. 


The command register is written by bringing Write- 
Enable to a logic-low level (Vj), while Chip-Enable is 
low. Addresses are latched on the falling edge of 
Write-Enable, while data is latched on the rising 
edge of the Write-Enable pulse. Standard microproc- 
essor write timings are used. 


Refer to AC Write Characteristics and the Erase/ 
Programming Waveforms for specific timing 
parameters. 


COMMAND DEFINITIONS 


When low voltage is applied to the Vpp pin, the con- 
tents of the command register default to 00H, en- 
abling read-only operations. 


Placing high voltage on the Vpp pin enables read/ 
write operations. Device operations are selected by 
writing specific data patterns into the command reg- 
ister. Table 3 defines these 28F512 register 
commands. 


Table 3. Command Definitions 


First Bus Cycle 


ion(1) 


Write 


Second Bus Cycle 


Operation(*)| Address(2)[Data(®)| Operation(")| Address(2)|Data(®) 
re 


NOTES: 
1. Bus operations are defined in Table 2. 


90H Read 


Write 
Read 
rite 

COH 


20H 


PVD 


= 


aa 
P 


4) 
Xx 
Xx 
A 
Xx 
Xx 


= 


Be) 
© 
© 
a. 


2. |A = Identifier address: OOH for manufacturer code, 01H for device code. 
EA = Address of memory location to be read during erase verify. 
PA = Address of memory location to be programmed. 
' Addresses are latched on the falling edge of the Write-Enable pulse. 
3. ID = Data read from location IA during device identification (Mfr = 89H, Device = B8H). 
EVD = Data read from location EA during erase verify. 
PD = Data to be programmed at location PA. Data is latched on the rising edge of Write-Enable. 
PVD = Data read from location PA during program verify. PA is latched on the Program command. 
Following the Read Intelligent ID command, two read operations access manufacturer and device codes. 
Figure 5 illustrates the Quick-Erase algorithm. 
Figure 4 illustrates the Quick-Pulse Programming algorithm. 
The second bus cycle must be followed by the desired command register write. 


Pe et 
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Read Command 


While Vpp is high, for erasure and programming, 
memory contents can be accessed via the read 
command. The read operation is initiated by writing 
OOH into the command register. Microprocessor 
read cycles retrieve array data. The device remains 
enabled for reads until the command register con- 
tents are altered. 


The default contents of the register upon Vpp pow- 
er-up is OOH. This default value ensures that no spu- 
rious alteration of memory contents occurs during 
the Vpp power transition. Where the Vpp supply is 
hard-wired to the 28F512, the device powers-up and 
remains enabled for reads until the command-regis- 
ter contents are changed. Refer to the AC Read 
Characteristics and Waveforms for specific timing 
parameters. 


Intelligent Identifier Command 


Flash-memories are intended for use in applications 
where the local CPU alters memory contents. As 
such, manufacturer- and device-codes must be ac- 
cessible while the device resides in the target sys- 
tem. PROM programmers typically access signature 
codes by raising A9 to a high voltage. However, mul- 
tiplexing high voltage onto address lines is not a de- 
sired system-design practice. 


The 28F512 contains an Intelligent Identifier opera- 
tion to supplement traditional PROM-programming 
methodology. The operation is initiated by writing 
90H into the command register. Following the com- 
mand write, a read cycle from address OOOOH re- 
trieves the manufacturer code of 89H. A read cycle 
from address 0001H returns the device code of 
B8H. To terminate the operation, it is necessary to 
write another valid command into the register. 


Set-up Erase/Erase Commands 


Set-up Erase is a command-only operation that 
stages the device for electrical erasure of all bytes in 
the array. The set-up erase operation is performed 
by writing 20H to the command register. 


To commence chip-erasure, the erase command 
(20H) must again be written to the register. The 
erase operation begins with the rising edge of the 
Write-Enable pulse and terminates with the rising 
edge of the next Write-Enable pulse (i.e., Erase-Veri- 
fy Command). 


This two-step sequence of set-up followed by execu- 
tion ensures that memory contents are not acciden- 
tally erased. Also, chip-erasure can only occur when 
high voltage is applied to the Vpp pin. In the absence 
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of this high voltage, memory contents are protected 
against erasure. Refer to AC Erase Characteristics 
and Waveforms for specific timing parameters. 


Erase-Verify Command 


The erase command erases all bytes of the array in 
parallel. After each erase operation, all bytes must 
be verified. The erase verify operation is initiated by 
writing AOH into the command register. The address 
for the byte to be verified must be supplied as it is 
latched on the falling edge of the Write-Enable 
pulse. The register write terminates the erase opera- 
tion with the rising edge of its Write-Enable pulse. 


The 28F512 applies an internally-generated margin 
voltage to the addressed byte. Reading FFH from 


the addressed byte indicates that all bits in the byte 


are erased. 


The erase-verify command must be written to the 
command register prior to each byte verification to 
latch its address. The process continues for each 
byte in the array until a byte does not return FFH 
data, or the last address is accessed. 


In the case where the data read is not FFH, another 
erase operation is performed. (Refer to Set-up 
Erase/Erase). Verification then resumes from the 
address of the last-verified byte. Once all bytes in 
the array have been verified, the erase step is com- 
plete. The device can be programmed. At this point, 
the verify operation is terminated by writing a valid 
command (e.g. Program Set-up) to the command 
register. Figure 5, the Quick-Erase algorithm, illus- 
trates how commands and bus operations are com- 
bined to perform electrical erasure of the 28F512. 
Refer to AC Erase Characteristics and Waveforms 
for specific timing parameters. 


Set-up Program/Program Commands 


Set-up program is a command-only operation that | 
stages the device for byte programming. Writing 40H 
into the command register performs the set-up 
operation. 


Once the program set-up operation is performed, 
the next Write-Enable pulse causes a transition to 
an active programming operation. Addresses are in- 
ternally latched on the falling edge of the Write-En- 
able pulse. Data is internally latched on the rising 
edge of the Write-Enable pulse. The rising edge of 
Write-Enable also begins the programming opera- 
tion. The programming operation terminates with the 
next rising edge of Write-Enable, used to write the 
program-verify command. Refer to AC Programming 
Characteristics and Waveforms for specific timing 
parameters. 
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Program-Verify Command 


The 28F512 is programmed on a byte-by-byte basis. 
Byte programming may occur sequentially or at ran- 
dom. Following each programming operation, the 
byte just programmed must be verified. 


The program-verify operation is initiated by writing 
COH into the command register. The register write 
terminates the programming operation with the ris- 
ing edge of its Write-Enable pulse. The program-ver- 
ify operation stages the device for verification of the 
byte last programmed. No new address information 
is latched. 


The 28F512 applies an internally-generated margin 
voltage to the byte. A microprocessor read cycle 
outputs the data. A successful comparison between 
the programmed byte and true data means that the 
byte is successfully programmed. Programming then 
proceeds to the next desired byte location. Figure 4, 
the 28F512 Quick-Pulse Programming algorithm, il- 
lustrates how commands are combined with bus op- 
erations to perform byte programming. Refer to AC 
Programming Characteristics and Waveforms for 
specific timing parameters. 


Reset Command 


A reset command is provided as a means to safely 
abort the erase- or program-command sequences. 
Following either set-up command (erase or program) 
with two consecutive writes of FFH will safely abort 
the operation. Memory contents will not be altered. 
A valid command must then be written to place the 
device in the desired state. 


EXTENDED ERASE/PROGRAM CYCLING 


EEPROM cycling failures have always concerned 
users. The high electrical field required by thin oxide 
EEPROMs for tunneling can literally tear apart the 
oxide at defect regions. To combat this, some sup- 
pliers have implemented redundancy schemes, re- 
ducing cycling failures to insignificant levels. Howev- 
er, redundancy requires that cell size be doubled— 
an expensive solution. 


Intel has designed extended cycling capability into 
its ETOX Il flash memory technology. Resulting im- 
provements in cycling reliability come without in- 
creasing memory cell size or complexity. First, an 
advanced tunnel oxide increases the charge carry- 
ing ability ten-fold. Second, the oxide area per cell 
subjected to the tunneling electric field is one-tenth 
that of common EEPROMs, minimizing the probabili- 
ty of oxide defects in the region. Finally, the peak 
electric field during erasure is approximately 2 MV/ 
cm lower than EEPROM. The lower electric field 
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greatly reduces oxide stress and the probability of 


failure—increasing time to wearout by a factor of 
100,000,000. 


The 28F512 is capable of 100,000 program/erase 
cycles. The device is programmed and erased using 
Intel’s Quick-Pulse Programming and Quick-Erase 
algorithms. Intel’s algorithmic approach uses a se- 
ries of operations (pulses), along with byte verifica- 
tion, to completely and reliably erase and program 
the device. 


For further information, see Reliability Report RR-60 
(ETOX-II Reliability Data Summary). 


QUICK-PULSE PROGRAMMING ALGORITHM 


The Quick-Pulse Programming algorithm uses pro- 
gramming operations of 10 ys duration. Each opera- 
tion is followed by a byte verification to determine 
when the addressed byte has been successfully pro- 
grammed. The algorithm allows for up to 25 pro- 
gramming operations per byte, although most bytes 
verify on the first or second operation. The entire 
sequence of programming and byte verification is 
performed with Vpp at high voltage. Figure 4 illus- 
trates the Quick-Pulse Programming algorithm. 


QUICK-ERASE ALGORITHM 


Intel’s Quick-Erase algorithm yields fast and reliable 
electrical erasure of memory contents. The algo- 
rithm employs a closed-loop flow, similar to the 
Quick-Pulse Programming algorithm, to simulta- 
neously remove charge from all bits in the array. 


Erasure begins with a read of memory contents. The 
28F512 is erased when shipped from the factory. 
Reading FFH data from the device would immedi- 
ately be followed by device programming. 


For devices being erased and reprogrammed, uni- 
form and reliable erasure is ensured by first pro- 
gramming all bits in the device to their charged state 
(Data = OOH). This is accomplished, using the 
Quick-Pulse Programming algorithm, in approxi- 
mately one second. 


Erase execution then continues with an initial erase 
operation. Erase verification (data = FFH) begins at 
address 0000H and continues through the array to 
the last address, or until data other than FFH is en- 
countered. With each erase operation, an increasing 
number of bytes verify to the erased state. Erase 
efficiency may be improved by storing the address of 
the last byte verified in a register. Following the next 
erase operation, verification starts at that stored ad- 
dress location. Erasure typically occurs in one sec- 
ond. Figure 5 illustrates the Quick-Erase algorithm. 


28F512 


Bus 
(4) Start Command Comments 
Programming Operation | Command 


Apply 
VppH [1] 


PLSCNT =0 


WRITE Set-up 
Program Cmd we 
rogram 


Write Program 
Cmd (A/D) Program 
Time Out 10 us 


Write Program 
Verify Cmd 


Time Out 6 us 


Read Data 
from Device 


Program(2) 
Verify 


Verify Standby 
Data 
Y 
Last 
Increment Address 
Address ? 


Y 
Write 
Read Cmd 
Apply Apply 
Vppy [1] Vppv [t] 


rogram 
Programming Error 
Completed 
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NOTES: 


Wait for Vpp Ramp to Vppy(1) 


Initialize Pulse-Count 


Data = 40H 
Valid Address/Data 


Duration of Program 
Operation (twHwH1) 


Data = COH; Stops Program 
Operation(S) 


tWHGL 
Read Byte to Verify 


Programming 


Compare Data Output to Data 
Expected 


Data = OOH, Resets the 
Register for Read Operations 


Wait for Vpp Ramp to Vpp; (1) 


1. See DC Characteristics for value of Vppy and Vpp,. 3. Refer to principles of operation. 


ming. A final read/compare may be performed (option- to ensure proper and reliable operation of the de- 


al) after the register is written with the Read command. vice. 


Figure 4. 28F512 Quick-Pulse Programming Algorithm 
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Program All 
Bytes to OOH 


Apply 
Vppu [1] 


ADDR = OOH 
PLSCNT = 0 


Write Erase 
Set-up Cmd 


Write 
Erase Cmd 
Time Out 10 ms 


Write Erase 
Verify Cmd 


Time Out 6 ws 


Read Data 
from Device 


N Last 
Increment Address 
Address 
Write 
Read Cmd 


Apply Apply 
Vppt [1] Vppr Lt] 


Erasure 
Completed 
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NOTES: 

1. See DC Characteristics for value of Vppy and Vpp,. 
2. Erase Verify is performed only after chip-erasure. A 
final read/compare may be performed (optional) after 
the register is written with the read command. 


Bus 


Entire memory must = 00H 
before erasure 


Use Quick-Pulse 
Programming Algorithm 
(Figure 4) 


Wait for Vpp Ramp to Vppy(1) 


Initialize Addresses and 
Pulse-Count 


Data = 20H 


Data = 20H 


Duration of Erase Operation 
(twHWH2) 


Erase(2) Addr = Byte to Verify; 
Verify Data = AOH; Stops Erase 
Operation(S) 


tWHGL 


Read Byte to Verify Erasure 


Standby Compare Output to FFH 


Increment Pulse-Count 


Write Data = OOH, Resets the 
Register for Read Operations 


Standby Wait for Vpp Ramp to Vpp; (1) 


3. Refer to principles of operation. : 

4. CAUTION: The algorithm MUST BE FOLLOWED 
to ensure proper and reliable operation of the de- 
vice. 


Figure 5. 28F512 Quick-Erase Algorithm 


5-74 


intel. 
DESIGN CONSIDERATIONS 


Two-Line Output Control 


Flash-memories are often used in larger memory ar- 
rays. Intel provides two read-control inputs to ac- 
commodate multiple memory connections. Two-line 
control provides for: 


a. the lowest possible memory power dissipation 
and, 


b. complete assurance that output bus contention 
will not occur. 


To efficiently use these two control inputs, an ad- 
dress-decoder output should drive chip-enable, 
while the system’s read signal controls all flash- 
memories and other parallel memories. This assures 
that only enabled memory devices have active out- 
puts, while deselected devices maintain the low 
power standby condition. 


Power Supply Decoupling 


Flash-memory power-switching characteristics re- 
quire careful device decoupling. System designers 
are interested in three supply current (Icc) issues— 
standby, active, and transient current peaks pro- 
duced by falling and rising edges of chip-enable. The 
capacitive and inductive loads on the device outputs 
determine the magnitudes of these peaks. 


Two-line control and proper decoupling capacitor 
selection will suppress transient voltage peaks. 
Each device should have a 0.1 wF ceramic capacitor 
connected between Vcc and Vss, and between Vpp 
and Vss. 


Place the high-frequency, low-inherent-inductance 
capacitors as close as possible to the devices. Also, 
for every eight devices, a 4.7 uF electrolytic capaci- 
tor should be placed at the array’s power supply 
connection, between Vcc and Vss. The bulk capaci- 
tor will overcome voltage slumps caused by printed- 
circuit-board trace inductance, and will supply 
charge to the smaller capacitors as needed. 


Vpp Trace on Printed Circuit Boards 


Programming flash-memories, while they reside in 
the target system, requires that the printed circuit 
board designer pay attention to the Vpp power sup- 
ply trace. The Vpp pin supplies the memory cell cur- 
rent for programming. Use similar trace widths and 
layout considerations given the Voc power bus. Ad- 
equate Vpp supply traces and decoupling will de- 
crease Vpp voltage spikes and overshoots. 


28F512 


Power Up/Down Protection 


The 28F512 is designed to offer protection against 
accidental erasure or programming during power 
transitions. Upon power-up, the 28F512 is indifferent 
as to which power supply, Vpp or Voc, powers up 
first. Power supply sequencing is not required. Inter- 
nal circuitry in the 28F512 ensures that the com- 
mand register is reset to the read mode on power 


up. 


A system designer must guard against active writes 
for Vcc voltages above Vixo when Vpp is active. 
Since both WE# and CE# must be low for a com- 
mand write, driving either to Vjy will inhibit writes. 
The control register architecture provides an added 
level of protection since alteration of memory con- 
tents only occurs after successful completion of the 
two-step command sequences. 


28F512 Power Dissipation 


When designing portable systems, designers must 
consider battery power consumption not only during 
device operation, but also for data retention during 
system idle time. Flash memory nonvolatility in- 
creases the usable battery life of your system be- 
cause the 28F512 does not consume any power to 
retain code or data when the system is off. Table 4 
illustrates the power dissipated when updating the 
28F512. 


Table 4. 28F512 Typical Update 
Power Dissipation(4) 


Power Dissipation 
(Watt-Seconde) 


Array Program/ 
Program Verify 


Array Erase/ 
Erase Verify 


One Complete Cycle} 3 | 


NOTES: 

1. Formula to calculate typical Program/Program Verify 
Power = [Vpp X # Bytes x Typical # Prog Pulses 
(twHWH1 X Ippo Typical + twHGL =< Ipp4 Typical)] + 
[Vcc X # Bytes x Typical # Prog Pulses (twHwH1 
Icce Typical + twHaL X< Ioc4 Typical). 

2. Formula to calculate typical Erase/Erase Verify Power 
= [Vpp(Ipp3 Typical < teRase Typical + Ipps Typical x 
twHGL < # Bytes)] + [Vcc(lcc3 Typical < teRase Typi- 
cal + Iocs Typical X twuaL < # Bytes)]. 

3. One Complete Cycle = Array Preprogram + Array 
Erase + Program. 

4. “Typicals” are not guaranteed, but based on a limited 
number of samples from production lots. 
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ABSOLUTE MAXIMUM RATINGS* 


Operating Temperature 


MUTA PABA 35a o.bd ao bap okt ent 0°C to + 70°C(1) 

During Erase/Program ......... 0°C to + 70°C(1) 
Operating Temperature 

DOMEPAOA . vee c-x5aklies —40°C to + 85°C(2) 

During Erase/Program ...... —40°C to + 85°C(2) 
Temperature Under Bias....... —10°C to + 80°C(1) 
Temperature Under Bias....... —50°C to + 95°C(2) 
Storage Temperature .......... ~65°C to + 126°C 
Voltage on Any Pin with 

Respect to Ground.......... —2.0V to +7.0V(2) 
Voltage on Pin Ag with 

Respect to Ground....... —2.0V to + 13.5V(2, 3) 
NOTES: 


Vpp Supply Voltage with 

Respect to Ground 

During Erase/Program ....—2.0V to + 14.0V(2, 3) 
Voc Supply Voltage with 

Respect to Ground.......... —2.0V to + 7.0V(2) 
Output Short Circuit Current............. 100 mA(4) 


* WARNING: Stressing the device beyond the “Absolute 
Maximum Ratings” may cause permanent damage. 
These are stress ratings only. Operation beyond the 
“Operating Conditions” is not recommended and ex- 
tended exposure beyond the “Operating Conditions” 
may affect device reliability. 


1. Operating temperature is for commercial product defined by this specification. 

2. Operating temperature is for extended temperature product defined by this specification. 

3. Minimum DC input voltage is —0.5V. During transitions, inputs may undershoot to —2.0V for periods less than 20 ns. 
Maximum DC voltage on output pins is Vcc + 0.5V, which may overshoot to Vcc + 2.0V for periods less than 20 ns. 

4. Maximum DC voltage on Ag or Vpp may overshoot to + 14.0V for periods less than 20 ns. 

5. Output shorted for no more than one second. No more than one output shorted at a time. 


OPERATING CONDITIONS 


70 °C 
for Commercial Products 


Ta Operating Temperature(1) 


ILo 
locs Voc Standby Current 


Voc Active Read Current 
loce Voc Programming 
Current 


Voc Erase Current 


loca Voc Program Verify 
Current 


Output Leakage Current 


5-76 


el Ce 


For Read-Only and 
Read/Write Operations 


For Read-Only and 
Read/Write Operations 
for Extended Temperature Products 


Test Conditions 


Voc = Voc Max 
Vin = Voc or Vss 
Voc = Voc Max 
Vout = Vcc or Vss 
cc = Vcc Max 
E# = Vin 
cc = Vcc Max, CE# = Vi, 
= 6 MHz, lout = OmA 


Vpp = VppH 
Program Verify in Progress 


ee 


intel. ‘< | o8F512 


DC CHARACTERIST ICS—TTL/NMOS COMPATIBLE—Commercial Products 
(Continued) 


Limits 
Parameter Notes | | eee Test Conditions 
sym ameter Tin | typ] Max | Tstcondtone 


locs Voc Erase Verify Current 15 MA | Vpp = VpppH 
Erase Verify in Progress 


Ventestagecunee | 1 [|| wa |palwrsvoo 


1 
Ipp4 Vpp Read Current, Standby 1 HA | Vpp > Voc 
Current, or ID Current 
e100 
Vpp Programming Current 1 Be mA | Vpp = Vppy 
Programming in Progress 
Vpp Erase Current Tee mA | Vpp = VppyH 
Erasure in Progress 
| Vpp Program Verify Current mA | Vpp = VppyH 
Program Verify in Progress 
Vpp Erase Verify Current 1,2 mA | Vpp = VppyH 
Erase Verify in Progress 
Ae Co Oe EC a A Se 


Input Low Voltage 
Input High Voltage + bof Woot te] av 


2.0 | aaa 
VoL Output Low Voltage 0.45 V |lot = 5.8mA 
. Voc = Vcc Min 
VoH1 Output High Voltage V | lon = —2.5mA 
Voc = Vec Min 
Vio__| Aginteligentidentifier Votage | | 11.50] Ey aaa 2 


Vip Ag Intelligent Identifier Voltage V 


VppL Vpp during Read-Only | V_ | NOTE: Erase/Program are 
Operations Inhibited when Vpp = Vpp,_ 


Limits 


+1.0 | pA | Voc = Voc Max 
Vin = Voc or Vss 


Voc = Voc Max 
Vout = Vcc or Vss 


loc1 | Voc Active Read Current | 1 10 mA | Voc = Vcc Max, CE# = ViL 
; f = 6 MHz, lout = OmA 
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DC CHARACTERISTICS—CMOS COMPATIBLE—Commercial Products (Continued) 


Parameter > = Test Conditions 
loce Voc Programming mA | Programming in Progress 
Current 


Vcc Program Verify liz mA | Vpp = VppH 
Current Program Verify in Progress 
locs Voc Erase Verify rot 


Vpp Leakage Current 


Vpp = VpPH 
Erase Verify in Progress 


+10.0 Es Vip. < Mines 


Vpp Read Current, ID 


Vpp > Voc 
Current, or Standby 
Current 


Vpp Programming 
Current 

Vpp Erase Current 

Vpp Program Verify 
Current 

Vpp Erase Verify Current 


Input Low Voltage 
Input High Voltage 


Vpp < Vcc 


. 


Vpp = VpPH 
Programming in Progress 


Vpp = VpPH 
Erasure in Progress 


Vpp = VpPH 
Program Verify in Progress 


Vpp = VpPH 
Erase Verify in Progress 


lo. = 5.8mA 
Voc = Vcc Min 


lon = —2.5 mA, 
Voc = Vcc Min 
lon = —100 pA, 
Voc = Voc Min 


Output High Voltage 


VoH1 


VoH2 


Ag Intelligent Identifier 
Voltage 
Ag Intelligent Identifier 
Current 


Vpp during Read-Only NOTE: Erase/Program 


are inneiied when 


VPPL 


Operations 


VPPH Vpp during Read/Write 
Operations 

VLKO Voc Erase/Write Lock 
Voltage 


: 

i 

aed 
eee | 
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oe Taleo een COMPATIBLE—Extended Temperature 
roducts 


eS 
Mi near a WM Ka onc 
Vin = Voc or Vssg 
Pl bon cel of EA eas = 
, Vout = Voc or Vss 
ie oer er et 
CE# = Vip 
or 6 MHz, lout = 0 mA 


ce NeePewanmicg cure _ Programming Current Pe eaes "ai | folded in Progress 


loos __|Voo Erase Current ariaaiccs ee Tae 


loca Vcc Program Verify Current 1,2 mA |Vpp = Vppy 

Program Verify in Progress 
locs Voc Erase Verify Current 2 mA | Vpp = VppH 

Erase Verify in Progress 


pps |VppLeakage Current | 10.0 | pe 0 on = Vo 
Ippy Vpp Read Current, Standby pn | 200 | pA 
Current, or ID Current +40. | +10.0 Vio = Nie ey att tay ce 


Vpp Programming Current mA |Vpp = Vppy 
Programming in Progress 

Vpp Erase Current Ine 4.0 mA |Vpp = VppH 

Erasure in Progress 

Vpp Program Verify Current MA |Vpp = VppyH 

Program Verify in Progress 
Vpp Erase Verify Current MA |Vpp = VppH 

Erase Verify in Progress 


Vi__[input Low Voltage SSRs Ts A Mere aa 


Input High Voltage : 
V jlo, = 5.8mA 
Voc = Vcc Min 


VoHi | Output High Voltage V |lon = —2.5mA 
Voc = Vcc Min 


tet Intelligent Identifier Voltage 
lin [Ag Intelligent Identifier Current 


Vpp_ __| Vpp during Read-Only 
Operations 

VppH | Vpp during Read/Write 11.40 
Operations 


Voc Erase/Write Lock Voltage 
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DC CHARACTERISTICS—CMOS COMPATIBLE—Extended Temperature 
Products 


| 
peer | | eee 
Vin = Voc or Vss 
eee 
Vout = Vcc or Vss 
peor Te = ee 
CE# = Vcc +0.2V 
cee ee eee 
f = 6 MHz, lout = OMA 


fee, [Nos Reser aren Programming oo ae | mA. ee in Progress 


feo ec krse Curent _ Program Verify nex 2 mA | Vpp = VppyH 
Current Program Verify in Progress 
locs Voc Erase Verify Current 1,2 mA | Vpp = VppyH 
Pepe Verify in Progress 
‘pps | Vpp Leakage Current Leakage Current : 2 ae 0 pee fee ee < Voc 
Vpp Read Current, ID wee Pear Wigee ep | > Voc 
Current, or Standby 
Vpp Programming Current mA | Vpp = VppyH 
Programming in Progress 
Vpp Erase Current &, 0 mA | Vpp = VppH 
Erasure in Progress 
Vpp Program Verify mA | Vpp = VppyH 
Current Program Verify in Progress 
Vpp Erase Verify Current MA | Vpp = VppyH 
Erase Verify in Progress 


eer [ef ae 
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DC CHARACTERISTICS—CMOS COMPATIBLE—Extended Temperature 
Products (Continued) 


Limits 
Parameter oes Test Conditions 
Tyo | ax 
Output High Voltage 0.85 Voc y | lon = —2.5mA, 


Ag Intelligent Identifier Voltage me oo) 


VppL Vpp during Read-Only Operations NOTE: Erase/ 
Program 

are Inhibited 
when 


Vpp = VppL 


Vpp during Read/Write Operations PP eg 


Voc Erase/Write Lock Voltage 


Stel= 
(“Aiibeon/CorwctCapaonance | 3 |_| 8 | | Wwew 


NOTES: 

1. All currents are in RMS unless otherwise noted. Typical values at Voc = 5.0V, Vpp = 12.0V, T = +25°C. These 
currents are valid for all product versions (packages and speeds). 

2. Not 100% tested: characterization data available. 

3. Sampled, not 100% tested. 

4. “Typicals” are not guaranteed, but based on a limited number of samples from production lots. 
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AC TESTING INPUT/OUTPUT WAVEFORM 


2.0 
an *> _TEST POINTS 


OUTPUT os > TEST POINTS 


290204-8 


AC Testing: Inputs are driven at 2.4V for a logic “1” and 0.45V for 
a logic “0”. Testing measurements are made at 2.0V for a logic 
“1” and 0.8V for a logic “0”. Rise/Fall time < 10 ns. 


290204-9 


C. = 100 pF 
C, includes Jig Capacitance 


AC TEST CONDITIONS 


Input Rise and Fall Times (10% to 90%)...... 10 ns 
Input Pulse Levels ................ 0.45V and 2.4V 
Input Timing Reference Level ....... 0.8V and 2.0V 
Output Timing Reference Level...... 0.8V and 2.0V 


AC CHARACTERISTICS—Read-Only Operations 


N28F512-120 
TN28F512-120 N28F512-150 
P28F512-120 P28F512-150 
TP28F512-120 


Versions(1) 


| Symbol — Characteristic 
Read Cycle Time 

Chip Enable Access Time 
Address Access Time 


Output Enable Access Time 
Chip Enable to Output in Low Z 


Chip Disable to Output in High Z 


Output Enable to Output in Low Z 
Output Disable to Output in High Z 


too Output Hold from Address, CE #, or 
OE # Change 


Write Recovery Time before Read 


NOTES: 

1. Model number prefixes: N = PLCC, P = PDIP, T = Extended Temperature. 
2. Sampled, not 100% tested. 

3. Guaranteed by design. 

4. Whichever occurs first. 


of 
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DEVICE AND 
Voc POWER-UP STANDBY ADDRESS SELECTION OUTPUTS ENABLED DATA VALID 


we XOX 


tavav (tec) 


CE# (E#) 
OE# (G#) 
WE# (W#) 
teLov (toe) 
trav (tog) 
terax (torz) >] 

teLox (tz) i 

DATA (DO) sie VALID OUTPUT 


Chas tavav (tacc) 


STANDBY Voc POWER-DOWN 


DOO 


teHoz 


\\\\ HIGH Z 
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AC CHARACTERISTICS—Write/Erase/Program Operations(1; 4) 


Versions 


| Symbol Characteristic 
Write Pulse Width 
Vpp Set-Up Time to Chip Enable Low 


NOTES: 

1. Read timing characteristics during read/write operations are the same as during read-only operations. Refer to AC Char- 
acteristics for Read-Only Operations. 

2. Guaranteed by design. 

3. The integrated stop timer terminates the programming/erase operations, thereby eliminating the need for a maximum 
specification. 

4. Erase/Program cycles on extended temperature products is 1,000 cycles. 


ERASE AND PROGRAMMING PERFORMANCE 


Limits 
Parameter Notes N/P28F512-120, 150 TN/TP28F512-120(6) 


Cin [tye [was 
a ad wat 
Hee GAS Sack 


Chip Erase 1,2, 4 
Time 
Chip Program 


Time 


NOTES: 

1. “Typicals” are not guaranteed, but based on a limited number of samples from production lots. Data taken at 25°C, 12.0V 
Vpp at 0 cycles. 

2. Minimum byte programming time excluding system overhead is 16 ys (10 ws program + 6 ys write recovery), while 
maximum is 400 ys/byte (16 ws x 25 loops allowed by algorithm). Max chip programming time is specified lower than the 
worst case allowed by the programming algorithm since most bytes program significantly faster than the worst case byte. 

3. Excludes 00H Programming Prior to Erasure. 

4. Excludes System-Level Overhead. 

5. Refer to RR-60 “ETOX Il Flash Memory Reliability Data Summary” for typical cycling data and failure rate calculations. 
6. Extended temperature products 
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Figure 7. 28F512 Typical Program Time at 12V 
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Figure 8. 28F512 Typical Programming Capability 
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Figure 9. 28F512 Typical Erase Time at 12V 
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Figure 10. 28F512 Typical Erase Capability 
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ALTERNATIVE CE #-CONTROLLED WRITES 


| Symbol | Characteristic 


ime 
tAVEL Address Set- 
Up Time 
ime 
ime 
ime 


tEHGL Write 
Recovery Time 
before Read 

tGHEL Read 
Recovery Time 
before Write 

tWLEL Write Enable 
Set-Up Time 
before Chip 
Enable 


tEHWH Write Enable 
Hold Time 

tELEH Write Pulse 
Width 

tEHEL Write Pulse 
Width High 

tVPEL Vpp Set-Up 
Time to Chip 
Enable Low 


NOTE: 

1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of Chip-Enable and Write-Enable. In 
systems where Chip-Enable defines the write pulse width (within a longer Write-Enable timing waveform) all set-up, hold and 
inactive Write-Enable times should be measured relative to the Chip-Enable waveform. 

2. Guaranteed by design. 
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Ordering Information 


TyPy2teltr ys} 1{2]-] i]2}o| 


PACKAGE ACCESS SPEED (ns) 
P=32-PIN PLASTIC DIP 120ns 
N = 32-LEAD PLCC 150 ns 


TEMPERATURE 
T = EXTENDED (-40°C TO +85°C) 


BLANK = COMMERCIAL (0°C TO +70°C) 
290204-13 


Valid Combinations: 


P28F512-120 N28F512-120 _ TP28F512-120 

P28F512-150 N28F512-150 TN28F 512-120 

ADDITIONAL INFORMATION Order Number 
ER-20, “ETOX Il Flash Memory Technology” 294005 
ER-24, “Intel Flash Memory” 294008 
RR-60, “ETOX II Flash Memory Reliability Data Summary” 293002 
AP-316, ‘‘Using Flash Memory for In-System Reprogrammable 292046 

Nonvolatile Storage” 
AP-325 ‘“‘Guide to Flash Memory Reprogramming”’ 292059 


REVISION HISTORY 


Description 


Removed 200 ns speed bin 
Revised Erase Maximum Pulse Count for Figure 5 from 3000 to 1000 
Clarified AC and DC test conditions 


| Corrected AC Waveforms 
Added Extended Temperature devices; TP28F512-120, TN28F512-120 


Revised symbols; i.e., CE, OE, etc. to CE#, OE#, etc. 
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28F256A 
256K (32K x 8) CMOS FLASH MEMORY 

@ Flash Electrical Chip-Erase m= Command Register Architecture for 

— 1 Second Typical Chip-Erase | Microprocessor/Microcontroller 
m Quick-Pulse Programming Algorithm Compatible Write Interface 

— 10 us Typical Byte-Program = Noise Immunity Features 

— 0.5 Second Chip-Program — +10% Vcc Tolerance 
m 100,000 Erase/Program Cycles — Maximum Latch-Up Immunity 


through EPI Processing 


+59 
m 12.0V +5% Vpp mg ETOX II Flash Nonvolatile Technology 


m High-Performance Read — EPROM-Compatible Process Base 
— 120 ns Maximum Access Time — High-Volume Manufacturing 
m= CMOS Low Power Consumption Experience 
— 10 mA Typical Active Current mw JEDEC-Standard Pinouts 
— 50 yA Typical Standby Current — 32-Pin PDIP 
— OW Data Retention Power — 32-Lead PLCC 
m Integrated Program/Erase Stop Timer SAE PACKING SEM Ee 


Intel’s 28F256A CMOS flash memory offers the most cost-effective and reliable alternative for read/write 
random access nonvolatile memory. The 28F256A adds electrical chip-erasure and reprogramming to familiar 
EPROM technology. Memory contents can be rewritten: in a test socket; in a PROM-programmer socket; on- 
board during subassembly test; in-system during final test; and in-system after-sale. The 28F256A increases 
memory flexibility, while contributing to time and cost savings. 


The 28F256A is a 256-kilobit nonvolatile memory organized as 32,768 bytes of 8 bits. Intel’s 28F256A is 
offered in 32-pin plastic dip and 32-lead PLCC. Pin assignments conform to JEDEC standards. 


Extended erase and program cycling capability is designed into Intel’s ETOX I! (EPROM Tunnel Oxide) pro- 
cess technology. Advanced oxide processing, an optimized tunneling structure, and lower electric field com- 
bine to extend reliable cycling beyond that of traditional EEPROMs. With the 12.0V Vpp supply, the 28F256A 
performs a minimum of 10,000 erase and program cycles well within the time limits of the Quick-Pulse Pro- 
gramming and Quick-Erase algorithms. 


Intel’s 28F256A employs advanced CMOS circuitry for systems requiring high-performance access speeds, . 
low power consumption, and immunity to noise. Its 120 ns access time provides no-WAIT-state performance 
for a wide range of microprocessors and microcontrollers. Typical standby current of 50 pA translates into 
power savings when the device is deselected. Finally, the highest degree of latch-up protection is achieved 
through Intel’s unique EPI processing. Prevention of latch-up is provided for stresses up to 100 mA on address 
and data pins, from —1V to Vcc + .1V. 


With Intel’s ETOX Il process base, the 28F256A levers years of EPROM experience to yield the highest levels 
of quality, reliability, and cost-effectiveness. 


October 1993 
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Figure 1. 28F256A Block Diagram 
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Figure 2. 28F256A Pin Configurations 
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Table 1. Pin Description 


APPLICATIONS 


The 28F256A flash memory provides nonvolatility 
along with the capability to perform over 100,000 
electrical chip-erasure/reprogram cycles. These fea- 
tures make the 28F256A an innovative alternative to 
disk, EEPROM, and battery-backed static RAM. 
Where periodic updates of code and data-tables are 
required, the 28F256A’s reprogrammability and non- 
volatility make it the obvious and ideal replacement 
for EPROM. 


Primary applications and operating systems stored 
in flash eliminate the slow disk-DRAM download pro- 
cess. This results in a dramatic enhancement of per- 
formance and substantial reduction of power con- 
sumption—considerations particularly important in 
portable equipment. Flash memory increases flexi- 
bility with electrical chip-erasure and in-system up- 
date capability of operating systems and application 
code. With updatable BIOS, system manufacturers 
can easily accommodate last-minute changes as re- 
visions are made. 


In diskless workstations and terminals, network traf- 


fic reduces to a minimum and systems become in- 
stant-on. Reliability exceeds that of electromechani- 
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| Symbol | Type Name and Function 


Ao-Ai4 INPUT ADDRESS INPUTS for memory addresses. Addresses are internally 
latched during a write cycle. 


DQ9-DQ7 INPUT/ | DATA INPUT/OUTPUT: Inputs data during memory write cycles; outputs 
OUTPUT | data during memory read cycles. The data pins are active high and float to 
tri-state OFF when the chip is deselected or the outputs are disabled. Data 
is internally latched during a write cycle. 

CE# INPUT CHIP ENABLE activates the device’s control logic, input buffers, 
decoders, and sense amplifiers. CE # is active low; CE # high deselects 
the memory device and reduces power consumption to standby levels. 

INPUT OUTPUT ENABLE gates the devices output through the data buffers 
during a read cycle. OE # is active low. 


7 WE # INPUT WRITE ENABLE controls writes to the control register and the array. Write 
enable is active low. Addresses are latched on the falling edge and data is 
latched on the rising edge of the WE # pulse. Note: With Vpp < 6.5V, 
memory contents cannot be altered. 


ERASE/PROGRAM POWER SUPPLY for writing the command register, 
erasing the entire array, or programming bytes in the array. 


a ee 

/ Veco —s«d| «S| DEVICE POWER SUPPLY (5V + 10%). 

by eee A ee OR oe 
} NC |__| NO INTERNAL CONNECTION to device. Pin may be driven or left floating. 


cal media. Often in these environments, power inter- 
rupts force extended re-boot periods for all net- 
worked terminals. This mishap is no longer an issue 
if boot code, operating systems, Communications 
protocols and primary applications are flash-resident 
in each terminal. 


For embedded systems that rely on dynamic RAM/ 
disk for main system memory or nonvolatile backup 
storage, the 28F256A provides higher performance, 
lower power consumption, instant-on capability, and 
allows an “execute in place’’ memory hierarchy for 
code and data table reading. Additionally, the flash 
memory is more rugged and reliable in harsh envi- 
ronments where extreme temperatures and shock 
can cause disk-based systems to fail. 


The need for code updates pervades all phases of a 
system’s life—from prototyping to system manufac- 
turing to after-sale service. The electrical chip-era- 
sure and reprogramming ability of the 28F256A al- 
lows in-circuit alterability; this eliminates unneces- 
sary handling and less-reliable socketed connec- 
tions, while adding greater test, manufacture, and 
update flexibility. 


Material and labor costs associated with code 
changes increases at higher levels of system inte- 


| 
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gration—the most costly being code updates after 
sale. Code “bugs”, or the desire to augment system 
functionality, prompt after-sale code updates. Field 
revision to EPROM-based code requires the remov- 
al of EPROM components or entire boards. With the 
28F 256A, code updates are implemented locally via 


an edge-connector, or remotely over a communica- 
tions link. 


For systems currently using a high-density static 
RAM/battery configuration for data accumulation, 
flash memory’s inherent nonvolatility eliminates the 
need for battery backup. The concern for battery 
failure no longer exists, an important consideration 
for portable equipment and medical instruments, 
both requiring continuous performance. In addition, 
flash memory offers a considerable cost advantage 
over static RAM. 


Flash memory’s electrical chip-erasure, byte pro- 
grammability and complete nonvolatility fit well with 
data accumulation and recording needs. Electrical 


80C 186 
SYSTEM BUS ° 


Ay Ais 


DQ, 3 DQ, 5 


28F256A 


chip-erasure gives the designer a “blank slate” in 
which to log or record data. Data can be periodically 
off-loaded for analysis and the flash memory erased 
producing a new “blank slate’”’. 


A high degree of on-chip feature integration simpli- 
fies memory-to-processor interfacing. Figure 3 de- 
picts two 28F256As tied to the 80C186 system bus. 
The 28F256A’s architecture minimizes interface cir- 
Cuitry needed for complete in-circuit updates of 
memory contents. 


With cost-effective in-system reprogramming, ex- 
tended cycling capability, and true nonvolatility, the 
28F 256A is a functional superset of one or more of 
the alternatives: EPROMs, EEPROMs, battery 
backed static RAM, or disk. EPROM-compatible 
read specifications, straightforward interfacing, and 
in-circuit alterability offer designers unlimited flexibili- 
ty to meet the high standards of today’s designs. 


Ao-At4 
DQ) -DQ, 
DQ) -DQ, 


28F256A 28F256A 
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Figure 3. 28F256As in a 80C 186 System 
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PRINCIPLES OF OPERATION 


Flash memory augments EPROM functionality with 
in-circuit electrical erasure and reprogramming. The 
28F256A introduces a command register to manage 
this new functionality. The command register allows 
for: 100% TTL-level control inputs; fixed power sup- 
ply during erasure and programming; and maximum 
EPROM compatibility. 


In the absence of high voltage on the Vpp pin, the 
28F 256A is a read-only memory. Manipulation of the 
external memory-control pins yields the standard 
EPROM read, standby, output disable, and Intelli- 
gent Identifier operations. 


The same EPROM read, standby, and output disable 
operations are available when high voltage is ap- 
plied to the Vpp pin. In addition, high voltage on Vpp 
enables erasure and programming of the device. All 
functions associated with altering memory con- 
tents—lIntelligent Identifier, erase, erase verify, pro- 
gram, and program verify—are accessed via the 
command register. 


Commands are written to the register using standard 
microprocessor write timings. Register contents 
serve as input to an internal state-machine which 
control the erase and programming circuitry. Write 
cycles also internally latch addresses and data 
needed for programming and erase operations. With 
the appropriate command written to the register, 
standard microprocessor read timings output array 
data, access the Intelligent Identifier codes, or out- 
put data for erase and program verification. 


Integrated Program/Erase Stop Timer 


Successive command write cycles define the dura- 
tion of program and erase operations; specifically, 
the program or erase time durations are normally 
terminated by associated program or erase verify 
commands. An integrated stop timer provides simpli- 
fied timing control over these operations; thus elimi- 
nating the need for maximum program/erase timing 
specifications. Programming and erase pulse dura- 
tions are minimums only. When the stop timer termi- 
nates a program or erase operation, the device en- 
ters an inactive state and remains inactive until re- 
ceiving the appropriate verify or reset command. 
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The command register is only active when Vpp is at 
high voltage. Depending upon the application, the 
system designer may choose to make the Vpp pow- 
er supply switchable—available only when memory 
updates are desired. When Vpp = Vpp,, the con- 
tents of the register default to the read command, 
making the 28F256A a read-only memory. In this 
mode, the memory contents cannot be altered. 


Write Protection 


Or, the system designer may choose to “hardwire’”’ 
Vpp, making the high voltage supply constantly 
available. In this case, all Command Register func- 
tions are inhibited whenever Vcc is below the write 
lockout voltage Vi xo. (See Power Up/Down Protec- 
tion). The 28F256A is designed to accommodate ei- 
ther design practice, and to encourage optimization 
of the processor-memory interface. 


The two-step program/erase write sequence to the 
Command Register provides additional software 
write protection. 


BUS OPERATIONS 


Read 


The 28F256A has two control functions, both of 
which must be logically active, to obtain data at the 
outputs. Chip-Enable (CE #) is the power control and 
should be used for device selection. Output-Enable 
(OE#) is the output control and should be used to 
gate data from the output pins, independent of de- 
vice selection. Refer to AC read timing waveforms. 


When Vpp is high (Vppy), the read operations can 
be used to access array data, to output the Intelli- 
gent Identifier codes, and to access data for pro- 
gram/erase verification. When Vpp is low (Vpp_), the 
read operation can access only the array data. 


Output Disable 


With Output-Enable at a logic-high level (Vj), output 
from the device is disabled. Output pins are placed 
in a high-impedance state. 


Standby 


With Chip-Enable at a logic-high level, the standby 
operation disables most of the 28F256A’s circuitry 
and substantially reduces device power consump- 
tion. The outputs are placed in a high-impedance 


a 
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state, independent of the Output-Enable signal. If 
the 28F256A is deselected during erasure, program- 
ming, or program/erase verification, the device 


draws active current until the operation is terminat- 
ed. 


Intelligent Identifier Operation 


The Intelligent Identifier operation outputs the manu- 
facturer code (89H) and device code (B9H). Pro- 
gramming equipment automatically matches the de- 
vice with its proper erase and programming algo- 
rithms. With Chip-Enable and Output-Enable at a 
logic low level, rising Ag to high voltage Vip (see 
D.C. Characteristics) activates the operation. Data 
read from locations OOOOH and 0001H represent the 
manufacturer’s code and the device code, respec- 
tively. 


The manufacturer- and device-codes can also be 
read via the command register, for instances where 
the 28F256A is erased and reprogrammed in the tar- 
get system. Following a write of 90H to the com- 
mand register, a read from address location OOOOH 
outputs the manufacturer code (89H). A read from 
address 0001H outputs the device code (B9H). 


Write 


Device erasure and programming are accomplished 
via the command register, when high voltage is ap- 


ss pace 


plied to the Vpp pin. The contents of the register 
serve as input to the internal state-machine. The 
state-machine outputs dictate the function of the de- 
vice. 


The command register itself does not occupy an ad- 
dressable memory location. The register is a latch 
used to store the command, along with address and 
data information needed to execute the command. 


The command register is written by bringing Write- 
Enable to a logic-low level (Vj), while Chip-Enable is 
low. Addresses are latched on the falling edge of 
Write-Enable, while data is latched on the rising 
edge of the Write-Enable pulse. Standard microproc- 
essor write timings are used. | 


Refer to AC Write Characteristics and the Erase/ 
Programming Waveforms for specific timing parame- 
ters. | 


| 


COMMAND DEFINITIONS 


When low voltage is applied to the Vpp pin, the con- 
tents of the command register default to os ihe en- 
abling read-only operations. | 


Placing high voltage on the Vpp pin enables read/ 
write operations. Device operations are selected by 
writing specific data patterns into the command reg- 
ister. Table 3 defines these 28F256A register com- 
mands. | 


Table 2. 28F256A Bus Operations | 


Operation Vea 


Output Disable 
H 


L 
Output Disable X(7) 


pte | cee oc+ | wee | Da9-Da, 


| x | wm | x | x 
V| 


Vin 


Standby(6) 
NOTES: 


1. Refer to DC Characteristics. When Vpp = Vppy memory contents can be read but not written or erased. 
2. Manufacturer and device codes may also be accessed via a command register write sequence. 

Refer to Table 3. All other addresses low. 

3. Vip is the Intelligent Identifier high voltage. Refer to D.C. Characteristics. 

4. Read operations with Vpp = Vppy may access array data or the Intelligent Identifier codes. 

5. With Vpp at high voltage, the standby current equals loc + Ipp (standby). 

6. Refer to Table 3 for valid Data-In during a write operation. 

7. X can be Vi, or Vip. 
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Table 3. Command Definitions 


Bus 


First Bus Cycle 


Second Bus Cycle 


Sos samt nn te 

aot we | ok | a 

2 | wie |x | 00H [res | | @ 

[2 | wie |x | 20H |wite | x | 20H 
Erase Verify(6) Write EVD 


NOTES: 

1. Bus operation are defined in Table 2. 

2. |A = Identifier address: OOH for manufacturer code, 01H for device code. 
EA = Address of memory location to be read during erase verify. 
PA = Address of memory location to be programmed. 
Addresses are latched on the falling edge of the Write-Enable pulse. 

3. ID = Data read from location IA during device identification. (Mfr = 89H, Device = B9H). 
EVD = Data read from location EA during erase verify. 
PD = Data to be programmed at location PA. Data is latched on the rising edge of the Write-Enable. 
PVD = Data read from location PA during program verify. PA is latched on the Program command. 
Following the Read Intelligent ID command, two read operations access manufacturer and device codes. 
Figure 4 illustrates the Quick-Pulse Programming Algorithm. 


4. 
5; 
6. Figure 5 illustrates the Quick-Erase Algorithm. 
7. 


The second bus cycle must be followed by the desired command register write. 


Read Command 


While Vpp is high, for erasure and programming, 
memory contents can be accessed via the read 
command. The read operation is initiated by writing 
OOH into the command register. Microprocessor 
read cycles retrieve array data. The device remains 
enabled for reads until the command register con- 
tents are altered. 


The default contents of the register upon Vpp pow- 
er-up is OOH. This default value ensures that no spu- 
rious alternation of memory contents occurs during 
the Vpp power transition. Where the Vpp supply is 
hard-wired to the 28F256A, the device powers-up 
and remains enabled for reads until the command 
register contents are changed. Refer to the AC 
Read Characteristics and Waveforms for specific 
timing parameters. 


intelligent Identifier Command 


Flash memories are intended for use in applications 
where the local CPU alters memory contents. As 
such, manufacturer- and device-codes must be ac- 
cessible while the device resides in the target sys- 
tem. PROM programmers typically access signature 
codes by raising Ag to a high voltage. However, mul- 
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tiplexing high voltage onto address lines is not a de- 
sired system-design practice. 


The 28F256A contains an Intelligent Identifier oper- 
ation to supplement traditional PROM-programming 
methodology. The operation is initiated by writing 
90H into the command register. Following the com- 
mand write, a read cycle from address OOOOH re- 
trieves the manufacturer code 89H. A’read cycle 
from address 0001H returns the device code B9H. 
To terminate the operation, it is necessary to write 
another valid command into the register. 


Set-Up Erase/Erase Commands 


Set-up Erase is a command-only operation that 
stages the device for electrical erase of all bytes in 
the array. The set-up erase operation is performed 
by writing 20H to the command register. To com- 
mence chip-erasure, the erase command (20H) 
must again be written to the register. The erase op- 
eration begins with the rising edge of the Write-En- 
able pulse and terminate with the rising edge of the 
next Write-Enable pulse (i.e., Erase-Verify Com- 
mand). 


This two-step sequence of set-up followed by execu- 
tion ensures that memory contents are not acciden- 
tally erased. Also, chip-erasure can only occur when 
high voltage is applied to the Vpp pin. In the absence 


@ 
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of this high voltage, memory contents are protected 


against erasure. Refer to AC Erase Characteristics 
and Waveforms for specific timing parameters. 


Erase-Verify Command 


The erase command erases all of the bytes of the 
array in parallel. After each erase operation, all bytes 
must be verified. The erase verify operation is initiat- 
ed by writing AOH into the command register. The 
address for the byte to be verified must be supplied 
as it is latched on the falling edge of the Write-En- 
able pulse. The register write terminates the erase 
operation with the rising edge of its Write-Enable 
pulse. 


The 28F256A applies an internally-generated margin 
voltage to the addressed byte. Reading FFH from 
the addressed byte indicates that all bits in the byte 
are erased. 


The erase-verify command must be written to the 
command register prior to each byte verification to 
latch its address. The process continues for each 
byte in the array until a byte does not return FFH 
data, or the last address is accessed. 


In the case where the data read is not FFH, another 
erase operation is performed. (Refer to Set-Up 
Erase/Erase.) Verification then resumes from the 
address of the last-verified byte. Once all bytes in 
the array have been verified, the erase step is com- 
plete. The device can be programmed. At this point, 
the verify operation is terminated by writing a valid 
command (e.g., Program Set-Up) to the command 
register. Figure 5, the Quick-Erase algorithm, illus- 
trates how commands and bus operations are com- 
bined to perform electrical erasure of the 28F256A. 
Refer to AC Erase Characteristics and Waveforms 
for specific timing parameters. 


Set-Up Program/Program Commands 


Set-up program is a command-only operation that 
stages the device for byte programming. Writing 40H 
into the command register performs the set-up oper- 
ation. 


Once the program set-up operation is performed, 
the next Write-Enable pulse causes a transition to 
an active programming operation. Addresses are in- 
ternally latched on the falling edge of the Write-En- 
able pulse. Data is internally latched on the rising 
edge of the Write-Enable pulse. The rising edge of 
Write-Enable also begins the programming opera- 
tion. The programming operation terminates with the 
next rising edge of Write-Enable, used to write the 
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program-verify command. Refer to AC Programming 
Characteristics and Waveforms for specific timing 
parameters. 


Program Verify Command 


The 28F256A is programmed on a byte-by-byte ba- 
sis. Byte programming may occur sequentially or at 
random. Following each programming operation, the 
byte just programmed must be verified. 


The program-verify operation is initiated by writing 
COH into the command register. The register write 
terminates the programming operation with the ris- 
ing edge of its Write-Enable pulse. The program-ver- 
ify operation stages the device for verification of the 
byte last programmed. No new address information 
is latched. 


The 28F256A applies an internally-generated margin 
voltage to the byte. A microprocessor read cycle 
outputs the data. A successful comparison between 
the programmed byte and true data means that the 
byte is successfully programmed. Programming then 
proceeds to the next desired byte location. Figure 4, 
the 28F256A Quick-Pulse Programming algorithm, il- 
lustrates how commands are combined with bus op- 
erations to perform byte programming. Refer to AC 
Programming Characteristics and Waveforms for 
specific timing parameters. 


Reset Command 


A reset command is provided as a means to safely 
abort the erase- or program-command sequences. 
Following either set-up command (erase or program) 
with two consecutive writes of FFH will safely abort 
the operation. Memory contents will not be altered. 
A valid command must then be written to place the 
device in the desired state. 


EXTENDED ERASE/PROGRAM 
CYCLING 


EEPROM cycling failures have always concerned 
users. The high electrical field required by thin oxide 
EEPROMs for tunneling can literally tear apart the 
oxide at defect regions. To combat this, some sup- 
pliers have implemented redundancy schemes, re- 
ducing cycling failures to insignificant levels. Howev- 
er, redundancy requires that cell size be doubled— 
an expensive solution. | 


Intel has designed extended cycling capability into 
its ETOX Il flash memory technology. Resulting im- 
provements in cycling reliability come without in- 
creasing memory cell size or complexity. First, an 
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advanced tunnel oxide increases the charge carry- 
ing ability ten-fold. Second, the oxide area per cell 
subjected to the tunneling electric field is one-tenth 
that of common EEPROMs, minimizing the probabili- 
ty of oxide defects in the region. Finally, the peak 
electric field during erasure is approximately 
2 MV/cm lower then EEPROM. The lower electric 
field greatly reduces oxide stress and the probability 
of failure—increasing time to wear out by a factor of 
100,000,000. | 


The 28F256A is capable of 100,000 program/erase 
cycles. The device is programmed and erased using 
Intel’s Quick-Pulse Programming and Quick-Erase 
algorithms. Intel’s algorithmic approach uses a se- 
ries of operations (pulses), along with byte verifica- 
tion, to completely and reliably erase and program 
the device. 


For further reliability information, see Reliability Re- 
port RR-60 (ETOX II Reliability Data Summary). 


QUICK-PULSE PROGRAMMING 
ALGORITHM 


The Quick-Pulse Programming algorithm uses pro- 
gramming operations of 10 ws duration. Each opera- 
tion is followed by a byte verification to determine 
when the addressed byte has been successfully pro- 
grammed. The algorithm allows for up to 25 pro- 
gramming operations per byte, although most bytes 
verify on the first or second operation. The entire 
sequence of programming and byte verification is 
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performed with Vpp at high voltage. Figure 4 illus- 
trates the Quick-Pulse Programming algorithm. 


QUICK-ERASE ALGORITHM 


Intel’s Quick-Erase algorithm yields fast and reliable 
electrical erasure of memory contents. The algo- 
rithm employs a closed-loop flow, similar to the 
Quick-Pulse Programming algorithm, to simulta- 
neously remove charge from all bits in the array. 
Erasure begins with a read of memory contents. The 
28F256A is erased when shipped from the factory. 
Reading FFH data from the device would immedi- 
ately be followed by device programming. 


For devices being erased and reprogrammed, uni- 
form and reliable erasure is ensured by first pro- 
gramming all bits in the device to their charged state 
(data = OOH). This is accomplished, using the 
Quick-Pulse Programming algorithm, in approxi- 
mately one-half second. 


Erase execution then continues with an initial erase 
operation. Erase verification (data = FFH) begins at 
address 0000H and continues through the array to 
the last address, or until data other than FFH is en- 
countered. With each erase operation, an increasing 
number of bytes verify to the erased state. Erase 
efficiency may be improved by storing the address of 
the last byte verified in a register. Following the next 
erase operation, verification starts at that stored ad- 
dress location. Erasure typically occurs in one sec- 
ond. Figure 5 illustrates the Quick-Erase algorithm. 


START 
PROGRAMMING 


(4) 
APPLY 
VPPH(1) 
PLSCNT = 


WRITE SET-UP 
PROGRAM CMD 


WRITE PROGRAM 
CMD (A/D) 
TIME OUT 10uS 
WRITE PROGRAM 
VERIFY CMD 
TIME OUT 6 uS 


READ DATA 
FROM DEVICE 


VERIFY 
DATA 


Y 


LAST 
ADDRESS 
? 


Y 


WRITE 
READ CMD 
APPLY APPLY 
VPPL(1) VPPL(1) 
PROGRAMMING toi 
COMPLETED 
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INCREMENT 
ADDRESS 


NOTES: 

1. See DC Characteristics for the value of Vppy and Vpp_. 
2. Program Verify is only performed after byte program- 
ming. A final read/compare may be performed (optional) 
after the register is written with the Read command. 

3. Refer to principles of operation. 

4. CAUTION: The algorithm MUST BE FOLLOWED to en- 
sure proper and reliable operation of the device. 


28F256A 


Bus 


Standby 


Wait for Vpp ramp 
to VppH (= 12.0V) (1) 


Initialize pulse-count 


Write Set-Up Data = 40H 


Program 


Write Program Valid address/data 


Standby Duration of Program 


operation (twHwH1) 
Data = COH; Stops (3) 
Program Operation 


tWHGL 


Write Program(2) 


Verify 


Standby 


Read Read byte to verify 


programming 


Standby Compare data output 


to data expected 


Write 


Data = OOH, resets the 
register for read 
operations. 

Wait for Vpp ramp 

to Vppi_(1) 


Standby 


Figure 4. 28F256A Quick-Pulse Programming Algorithm 
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ADDRESS 


NOTES: 

1. See DC Characteristics for the value of Vppy and Vpp_. 
2. Erase Verify is performed only after chip-erasure. A final 
read/compare may be performed (optional) after the regis- 
ter is written with the Read command. 
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Bus Command Comments 
Operation 


Standby 


Wait for Vpp ramp 
to VppH (= 12.0V) (1) 
Use Quick-Pulse 

Programming (Fig. 4) 


Initialize Addresses, 
Erase Pulse Width, 
and Pulse Count 


Write Data = 20H 


Write Data = 20H 


Duration of Erase 
operation (twHwuH2) 
Addr = Byte to verify; 
Data = AOH; Stops 
Erase Operation (3) 
tWHGL 


Standby 


Write Erase 


Verify(2) 


Standby 


Read Read byte to verify 


erasure 


Standby Compare output to FFH 


increment pulse count 


Write 


Data = OOH, resets the 
register for read 
operations. 

Wait for Vpp ramp 

to Vpp_(1) 


Standby 


3. Refer to principles of operation. 
4. CAUTION: The algorithm MUST BE FOLLOWED to en- 
sure proper and reliable operation of the device. 


Figure 5. 28F256A Quick-Erase Algorithm 
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DESIGN CONSIDERATIONS 
Two-Line Output Control 


Flash memories are often used in larger memory ar- 
rays. Intel provides two read-control inputs to ac- 
commodate multiple memory connections. Two-line 
control provides for: 


a. the lowest possible memory power dissipation, 
and 


b. complete assurance that output bus contention 
will not occur. 


To efficiently use these two control units, an ad- 
dress-decoder output should drive chip-enable, 
while the system’s read signal controls all flash 
memories and other parallel memories. This assures 
that only enabled memory devices have active out- 
puts, while deselected devices maintain the low 
power standby condition. 


Power Supply Decoupling 


Flash memory power-switching characteristics re- 
quire careful device decoupling. System designers 
are interested in three supply current (Icc) issues— 
standby, active, and transient current peaks pro- 
duced by falling and rising edges of chip-enable. The 
Capacitive and inductive loads on the device outputs 
determine the magnitudes of these peaks. 


Two-line control and proper decoupling capacitor 
selection will suppress transient voltage peaks. 
Each device should have a 0.1 F ceramic capacitor 
connected between Vcc and Vss, and between Vpp 
and Vss. 


Place the high-frequency, low-inherent-inductance 
capacitors as close as possible to the devices. Also, 
for every eight devices, a 4.7 uF electrolytic capaci- 
tor should be placed at the array’s power supply 
connection, between Vcc and Vss. The bulk capaci- 
tor will overcome voltage slumps caused by printed- 
circuit-board trace inductance, and will supply 
charge to the smaller capacitors as needed. 


28F256A 


Vpp Trace on Printed Circuit Boards 


Programming flash memories, while they reside in 
the target smith, requires that the printed circuit 
board designer pay attention to the Vpp pin power 
supply trace. Use similar trace widths and layout 
considerations given the Voc power bus. Adequate 
Vpp supply traces and decoupling will decrease Vpp 
voltage spikes and overshoots. 


Power Up/Down Protection 


The 28F256A is designed to offer protection against 


accidental erasure or programming during power 
transitions. Upon power-up, the 28F256A is indiffer- 
ent as to which power supply, Vpp or Voc, powers 
up first. Power supply sequencing is not required. 
Internal circuitry in the 28F256A ensures that the 
command register is reset to the read. mode upon 
power up. 


A system designer must guard against active writes 
for Vcc voltages above Vi xo when Vpp is active. 
Since both WE# and CE# must be low for a com- 
mand write, driving either to Viy will inhibit writes. 
The control register architecture provides an added 
level of protection since alteration of memory con- 
tents only occurs after successful completion of the 
two-step command sequences. 


28F 256A Power Dissipation 


When designing portable systems, designers must 
consider battery power consumption not only during 
device operation, but also for data retention during 
system idle time. Flash nonvolatility increases the 
usable battery life of your system because the 
28F256A does not consume any power to retain 
code or data when the system is off. Table 4 illus- 
trates the power dissipated when updating the 
28F 256A. 


Table 4. 28F256A Typical Update Power Dissipation(4) 


Power Dissipation 
(Watt-Seconds) 


1 
Array Erase/Erase Verify | 0.083 | 2 
NOTES: 


1. Formula to calculate typical Program/Program Verify Power = [Vpp < # Bytes X typical # Prog Pulses (twHwH1 
Ippo typical + twHat X Ippg typical)] + [Vcc <X # Bytes x typical # Prog Pulses (twHwH1 X Icce2 typical + twHeL = 
loca typical)]. 

2. Formula to calculate typical Erase/Erase Verify Power = [Vpp (Ipp3 typical < teRase typical + Ipps typical < twHaL x 
# Bytes)] + [Vcoc(Icoc3 typical < teRase typical + Iocs typical x twHGL < # Bytes)]. 

3. One Complete Cycle = Array Preprogram + Array Erase + Program. 

4. “Typicals” are not guaranteed, but based on a limited number of samples from production lots. 
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ABSOLUTE MAXIMUM RATINGS* 


Operating Temperature 0°C to +70°C(") * WARNING: Stressing the device beyond the “Absolute 


DUP TIGG 4 0% 6 <5 es oven Hoes , ite 
. “ Maximum Ratings’ may cause permanent damage. 
During Erase/ Program j«.ns «0+. ie to G'S These are stress ratings only. Operation beyond the 
, ‘ G “Operating Conditions” is not recommended and ex- 
Temperature Under Bias......... —10°C to + 80°C tended exposure beyond the “Operating Conditions” 
may affect device reliability. 
Storage Temperature .......... -65'C to + 125°C 


Voltage on Any Pin with 
Respect to Ground.......... —2.0V to +7.0V(2) 


Voltage on Pin Ag with 
Respect to Ground....... —2.0V to + 13.5V(2, 3) 


Vpp Supply Voltage with 
Respect to Ground 


During Erase/Program ..... —2.0V to + 14.02, 3) 
Voc Supply Voltage with 

Respect to Ground.......... —2.0V to + 7.0V(2) 
Output Short Circuit Current............. 100 mA(4) 
NOTES: 


1. Operating temperature is for commercial product defined by this specification. 

2. Minimum DC input voltage is —0.5V. During transitions, inputs may undershoot to —2.0V for periods less than 20 ns. 
Maximum DC voltage on output pins is Voc +0.5V, which may overshoot to Voc + 2.0V for periods less than 20 ns. 

3. Maximum DC voltage on Ag or Vpp may overshoot to + 14.0V for periods less than 20 ns. 

4. Output shorted for no more than one second. No more than one output shorted at a time. 


j uot | comments 
°C _ For Read-Only and 
Read/Write Operations 


OPERATING CONDITIONS 


j symbot | rarmer | tnt 
an tee 


Voc Supply Voltage 
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DC CHARACTERISTICS—TTL/NMOS COMPATIBLE 
lead 


Limits 
Vcc = Voc max 
Vout = Vcc or Vss 


Typical()| Max | 
Si 
Vin = Voc or Vss 
ma Mon = Vocmax 
CE# = Vin 
Voc = Vocmax CE # = Vi, 


uw 
pA 
mA 
mA 

f = 6 MHz, lout = OMA 
A 
A 
mA 


—s 


— 
. . oO 


CC1 Vcc Active Read Current a 


CC2 Voc Programming Current 
CC3 Voc Erasure Current 


Min 

S 
a 
i 
Liab 
BS 
i 
i a 
pps ee 
ne ES 
wall i 
iam ie 
a 
wie is 

=0.5 


Programming in Progress 
Erasure in Progress 


1 mA |Vpp = VppH 
Program Verify in Progress 
Vpp = VppH 
Erase Verify in Progress 
A 


2) 


Vpp Leakage Current 
Ipp4 Vpp Read Current, ID Current, 

or Standby Current 

Vpp Programming Current 

Vpp Erase Current kas 


Vpp = VppH 
Programming in Progress 


eal Vpp = VpPH 
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pe 
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Erasure in Progress 
mA 


PP4 Vpp Program Verify Current Vpp = VppH 
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Mu___|InputLow Voltage | 
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Voui |Output High Voltage V ilon = —2.5mA 
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Vip Ag Intelligent Identifier 11.50 ; 
Voltage 
Ag Intelligent Identifier 1,2 BA |Ag = Vip 
Current 


Vpp_ __|Vpp During Read-Only V |Note: Erase/Program are 
Operations Inhibited when Vpp = Vpp. 
VppH  |Vpp During Read/Write 11.40 
_ |Operations 


Voc Erase/Write Lock Voltage | ead 


28F256A | intel : 
DC CHARACTERISTICS—CMOS COMPATIBLE 


Limits 
Voc = Voc max 
Vin = Voc or Vss 


4 


=) 


A\Vcoc = Voc max 
Vout = Vcc or Vss 
Voc = Vecmax 
CE# = Vcc +0.2V 
Voc = Vocmax CE# = Vi, 
f = 6 MHz, lout = OMA 
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Program Verify in Progress 
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VppL Vpp During Read-Only V_ | Note: Erase/Program are 
Operations Inhibited when Vpp = Vpp,_ 
VppH | Vpp During Read/Write V 
Operations 


Voc Erase/Write Lock Voltage 


Cin Address/Control 
Capacitance 
Output Capacitance 


_ NOTES FOR DC CHARACTERISTICS AND CAPACITANCE: 

1. All currents are in RMS unless otherwise noted. Typical values at Voc = 5.0V, Vpp = 12.0V, T = 25°C. These currents 
are valid for all product versions (Packages and Speeds). 

2. Not 100% tested: characterization data available. 

3. Sampled, not 100% tested. 

4. “Typicals” are not guaranteed, but based on a limited number of samples from production lots. 


AC TESTING INPUT/OUTPUT WAVEFORM AC TESTING LOAD CIRCUIT 


2.4 
INPUT tg >> TEST POINTS 
0.45 : 


OUTPUT vg >> TEST POINTS 


290243-7 


AC Testing: Inputs are driven at 2.5V for a logic “1” and 0.45 for a 
logic “0”. Testing measurements are made at 2.0 for a logic “1” 
and 0.8 for a logic “0”. Rise/Fall time < 10 ns. 


C, = 100 pF 290243-8 
C, includes Jig Capacitance 


AC Test Conditions 

Input Rise and Fall Times (10% to 90%)...... 10 ns 
Input Pulse Levels ................... 0.45 and 2.4 
Input Timing Reference Level .......... 0.8 and 2.0 
Output Timing Reference Level......... 0.8 and 2.0 
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AC CHARACTERISTICS Read-Only Operations 


Versions Notes 
| Symbol Characteristic 
tavav/trac Read Cycle Time 


Chip Enable Access Time 


Address Access Time Bes 
teLav/toe Output Enable 
Access Time 
teLax/tLz Chip Enable to Output 
in Low Z 
tEHQZ Chip Disable to Output 
in High Z 
~ teLtax/to_z | Output Enable to Output 
in Low Z 
tGHaz/tpr Output Disable to Output 
in High Z 
toH Output Hold from Address, 2 
CE #, or OE # Change 
tWHGL Write Recovery Time 
before Read 
NOTES: 
1. Whichever occurs first. 


2. Sampled, not 100% tested. 
3. Guaranteed by design. 


DEVICE AND 
Voc POWER-UP STANDBY ADDRESS SELECTION OUTPUTS ENABLED DATA VALID ‘ STANDBY Voc POWER DOWN 


a YOOX DOO 


tavav (tec) 


CE# (E#) 
OE# (G#) 


WE# (W#) 


teLax (4z) 


DATA (DQ) 


on tavev (tacc) 
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Figure 6. AC Waveform for Read Operations 
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AC CHARACTERISTICS—For Write/Erase/Program Operations(’) 


Notes |__28F256A-120 | — 28F256A-150 
| Symbol | Characteristic 

Write Cycle Time 
Address Set-Up Time 


Address Hold Time 
Data Set-Up Time 
Data Hold Time 


tWHGL Write Recovery Time 
before Read 
tGHWL Read Recovery Time 
before Write 
teLwL/tcs Chip Enable Set-Up 
Time before Write 
Chip Enable Hold Time 


Write Pulse Width 
Write Pulse Width High 


tWHWH1 Duration of 

Programming Operation 
tWHWH2 Duration of 

Erase Operation 
tyPEL Vpp Set-Up Time to 

Chip Enable Low 


NOTES: 

1. Read timing parameters during read/write operations are the same as during read-only operations. Refer to AC Charac- 
teristics for Read-Only Operations. 

2. Guaranteed by design. 

3. The integrated stop timer terminates the programming/erase operations, thereby eliminating the need for a maximum 
specification. 


ERASE AND PROGRAMMING PERFORMANCE 


Limits 


NOTES: 

1. “Typicals” are not guaranteed, but based on a limited number of samples taken from production lots. Data taken at 25°C, 
12.0V Vpp, at 0 cycles. 

2. Minimum byte programming time excluding system overhead is 16 xs program + 6 us write recovery), while maximum is 
400 ps/byte (16 ys x 25 loops allowed by algorithm). Max chip programming is specified lower than the worst case allowed 
by the programming algorithm since most bytes program significantly faster than the worst case byte. 

3. Excludes 00H Programming Prior to Erasure. 

4. Excludes System-Level Overhead. 

5. Refer to RR-60 “ETOX” Il Flash Memory Reliability Data Summary for typical cycling data and failure rate calculations. 
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Figure 7. 28F256A Typical Programming Capability 
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Figure 8. 28F256A Typical Program Time at 12V 
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Figure 9. 28F256A Typical Erase Capability 
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Figure 10. 28F256A Typical Erase Time at 12.0V 
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ALTERNATIVE CE#-CONTROLLED WRITES 


28F256A-120 28F256A-150 


Versions 


| Symbol _ Characteristic 
tavav 


tavav Write Cycle Time 


Address Set-Up Time 
Address Hold Time 
Data Set-Up Time 
Data Hold Time 


aiesbers 
a 
sag ae 
ae 
ice oad 
Write Recovery Time ee 
before Read 
Pies. 
ee ae 


= 
” 


tGHEL Read Recover Time 
before Write 
| tWLEL Write Enable Set-Up Time 
before Chip-Enable 
Write Enable Hold Time 


Write Pulse Width 
Write Pulse Width High 


Vpp Set-Up Time 


to Chip-Enable Low 
NOTE: 


1. Chip-Enable Controlled Writes: Write operations are driven by the valid combination of Chip-Enable and Write-Enable. In 
systems where Chip-Enable defines the write pulse width (with a longer Write-Enable timing waveform) all set-up, hold and 
inactive Write-Enable times should be measured relative to the Chip-Enable waveform. 

2. Guaranteed by design. 
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ORDERING INFORMATION 


Plzfefrlztstefal-]sjzfo 
i PACKAGE | 
P=32-PIN PLASTIC DIP ACCESS SPEED (ns) 


N= 32-LEAD PLCC 120 ns 
150 ns 


VALID COMBINATIONS: N28F256A-120 
P28F256A-120 N28F256A-150 
P28F256A-150 
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ADDITIONAL INFORMATION 


Order Number 
ER-20, “ETOX Il Flash Memory Technology”’ 294005 
ER-24, “Intel Flash Memory” 294008 
RR-60, “ETOX II Flash Memory Reliability Data Summary” 293002 
AP-316, “Using Flash Memory for In-System Reprogramming 292046 
Nonvolatile Storage” 
AP-325, “Guide to Flash Memory Reprogramming’”’ 292059 


REVISION HISTORY 


i (2. ee Poe 


Removed Preliminary Classification. 
Removed 200 ns speed bin. 
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Clarified AC and DC test conditions. 


Corrected AC waveforms. 


Revised symbols; i.e., CE, OE, etc. to CE#, OE#, etc. 
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1.0 INTRODUCTION 


Intel’s ETOX II (EPROM tunnel oxide) flash memory 
technology uses a single-transistor cell to provide in- 
system reprogrammable nonvolatile storage. Repro- 
gramming entails electrically erasing all bits in parallel 
and then randomly programming any byte in the array. 
This new technology offers designers alternatives for 
two of industry’s needs: 1) a cost-effective means of 
updating program code; and 2) a solid-state approach 
for non-volatile data accumulation or storage. 


This application note: 
© introduces you to the concepts of in-system writing; 


© discusses the hardware and software considerations 
for reprogramming flash memories in-system; 


© offers a checklist for integrating Intel’s flash memo- 
ries into microprocessor- or microcontroller-based 
systems; and 


e@ shows an example of an 80C186 design which incor- 
porates flash memory. 


1.1 PROM Programmer vs System- 
Processor Controlled 
Programming 


While soldered to a printed circuit board, one of two 
sources controls flash memory reprogramming: 1) a 
PROM programmer connected to the board, or 2) the 
system’s own central processing unit (CPU). These are 
called on-board programming (OBP), and in-system 
writing (ISW), respectively. With OBP, the PROM 
programmer supplies the programming voltage (Vpp) 
and the programming intelligence; with ISW, Vpp is 
generated locally and the system itself drives the repro- 
gramming process. Both methods offer a variety of ben- 
efits. However this application note focuses on ISW. 


On-Board Programming 
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ae 
intel ° 
NOTE: 
See Appendix A for OPB design considerations. 


1.2 Information Download and Upload 


ETOX< II flash memory technology programs extreme- 
ly quick, permitting “on-the-fly” programming with. 
unbuffered 19.2K baud data input. The remote ISW 
system handles the serial communication link for the 
host interface, as well as the flash memory reprogram- 
ming. 


Version Updates (Download) 


Flash memories enable code version updates using sim- 
ple hardware designs. Beyond the basic system, a local 
Vpp supply is all that is needed for remote code down- 
load. 


A central host computer can download program code 
to many remote systems. Flash memory offers this ca- 
pability without the drawbacks of other technologies. It 
is solid-state and nonvolatile, thus eliminating mechani- 
cal component wear-out (common with disk drives) 
and the risk of losing updates (a concern with battery- 
backed RAM). These aspects of flash memory offer 
major advantages in automated factories, remote sys- 
tems, portable equipment and other applications. Final- 
ly, flash memories provide this capability at a much 
lower cost than byte-alterable EEPROM and battery- 
backed SRAM. 


Data Acquisition (Upload) 


Intel’s flash memories allow single-byte programming 
for data accumulation applications. A remote data-log- 
ger uploads its information to a central host via serial 
link. The flash memory device is then in-system erased 


In-System Writing 


REMOTE SYSTEM 


FILE SERVER 
292046-2 


Figure 1. These diagrams illustrate OBP and ISW. In OBP, a PROM programmer updates a system’s 
flash memory. The ISW diagram shows a host updating remote flash memory via serial link. The 
remote system performs the flash reprogramming with its own CPU. 


Intel’s ETOX flash memory process has patents pending. 
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for resumption of data acquisition. This is useful in an 
advanced electrical power meter, for example. It could 
be configured to track and monitor power usage and 
report the data to a central computer for billing and 


utility management. This reduces the cost of manual 
door-to-door meter reading. 


2.0 DEVICE FEATURES AND ISW 
APPLICATION CONSIDERATIONS 


This section gives a brief overview of Intel’s flash mem- 
ory features and explains how they facilitate ISW de- 
sign. 
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2.1 Flash Memory Pinouts 


The 32-pin DIP memory site is forward-compatible 
from the 256K bit to the 2 Mbit flash memory density. 
It fits into the 27C010 Mbit EPROM pinout and re- 
quires no multiplexed pins. Also, with just a single cir- 
cuit-board jumper trace, a 28-pin EPROM can be 
placed in the lower pins of the 32-pin flash memory 
site. (See Figures 2A and 2B, Flash Memory Pinouts.) 
For more information on intertechnology pin compati- 
bility see Ap Brief AB-25. 


Byte-Wide Flash Memory in 32-Pin DIP 


1M (128Kx8) 
512K (64Kx8) 
256K (32Kx8) 


1 

2 
3 
4 
5 
6 
7 
8 


32 PIN DIP 
0.800" WIDE 


TOP VIEW 
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Figure 2A. Flash Memory Pinouts 
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Byte-Wide Flash Memory in 32-Pin PLCC 
2M (256K X 8) 
1M (128K X 8) 
512K (64K X 8) 


256K (32K X 8) 


32-LEAD PLCC 
0.450" x 0.550" 


TOP VIEW 
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Figure 2B. Flash Memory Pinouts 
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Table 1. Command Register Instructions 


First Bus Cycle 


| Write | x | 
| Write | xX | 
| write | x | 
| EA 
eae 


Second Bus Cycle 
Command 


Read Memory(3) 1 
Read Intelligent Identifier 

Set-Up Erase/Erase 

Erase Verify 


Write 


| 00H 
| 90H | 
| 20H | 
| 40H | Write | PA | 


H 
| Write | x [| CoH | Read | x | PVD 
| Write | x | FFH | write | x | FFH 


Reset(3) 


NOTES: 


X 
X 
X 

EA 
¥ 
x 
X 


0 
40 
FF 


1. Addresses are latched on the falling edge of the Write-Enable pulse. 
EA = Address of memory location to be read during erase verify. 
PA = Address of memory location to be read during program verify. 


2. EVD = Data read from location EA during erase verify. 


PD = Data to be programmed at location PA. Data is latched on the rising edge of Write-Enable. 
PVD = Data read from location PA during program verify. PA is latched on the Program command. 
3. The second bus cycle must be followed by the next desired command register write, given the proper delay times. 


2.2 Command Register Architecture 


Simplified Processor Interface 


Intel’s command register architecture simplifies the 
processor interface. The command register allows 


CE#, WE#, and OE# to have standard read/write ‘ 


functionality. All commands such as “Set-up Program” 
or “Program Verify” can be written with standard sys- 
tem timings. Raising Vpp to 12V enables the command 
register for memory read/write operation, while lower- 
ing Vpp below Vcc + 2V restores the device to a read 
only memory. 


Writing to the register toggles an internal state-ma- 
chine. The state-machine output controls device func- 
tionality. Some commands require one write cycle, 
while others require two. The command register itself 
does not occupy an addressable memory location. The 
register simply stores the command, along with address 
and data needed to execute the command. With this 
architecture, the device expects the first write cycle to 
be a command and does not corrupt data at the speci- 
fied address. Table 1 contains a list of command regis- 
ter instructions. 


The following sections describe the commands in rela- 
tion to device operation. For more information on the 
command register see the appropriate flash memory 
data sheets, and Section 4.4 “Reprogramming Rou- 
tines”. 


Read Memory Command—00H 
This command allows for normal memory read opera- 


tions with Vpp turned on. After writing the command 
and waiting 6 ys, the CPU can read from the memory 


at system speeds. Once placed in the read mode no 
further action is required on the command register for 
subsequent read operations. 


Read Intelligent Identifier Command—90H 


Most PROM programmers read the device’s intelligent 
identifier to select the proper programming algorithm. 
On EPROMs, raising A9 to the Vpp level configures 
the device for this purpose. Since this is unacceptable 
in-system, you can read the flash memory intelligent 
identifier by first writing command 90H. Follow this by 
reading address 0000 and 0001H for the manufacturer 
and device ID. Reset the device with the Read Memory 
command after you have read the identifier. 


Set-Up Erase/Erase Commands—20H 


Write this command (20H) twice in succession to initi- 
ate erasure. The first write cycle sets up the device for 
erasure. The device starts erasing itself on the second 
command’s rising edge of Write-Enable. Erasure is 
stopped when the CPU issues the Erase Verify com- 
mand or when the device’s integrated stop timer times 
out. Integrated stop timers provide a safety net for 
complex system environments. In these environments, 
s/w timer accuracy may be difficult to achieve. Some 
method of timing is still required, however the timer 
need only meet a minimum specification (10 ms). This 
is far easier than calibrating a timer to meet both a 
minimum and maximum specification (10 ms 
+ 500 ps). 


NOTE: 
Prior to erasure, it is necessary to program all bytes to 
the same level (data = OOH). See the Quick-Erase al- 
gorithm for more details. 
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Erase Verify Command—A0H 


The erase command erases all bytes of the array in par- 
allel. After each erase operation, all bytes must be veri- 
fied to see if they erased. Write the Erase Verify com- 
mand (AOH) to stop erasure and setup verification. 


Alternatively, you may allow the internal stop timer to 
halt erasure. You must still issue the Erase Verify com- 
mand to set up verification. 


The device latches the address to be verified on the 
falling edge of WE# and the actual command on the 
rising edge. Wait 6 us before reading the data at the 
address specified on the previous write cycle. 


The flash memory applies an internally-generated refer- 
ence voltage to the addressed byte. Reading OFFH from 
the addressed byte in this mode indicates that all bits in 
the byte are erased with sufficient margin to Vcc and 
temperature fluctuations. 


If the location is erased, then repeat the Erase Verify 
procedure for the next address location. Write the com- 
mand prior to each byte verification to latch the byte’s 
address. Continue this process for each byte in the ar- 
ray until a byte does not return OFFH data, or the last 
address is accessed. 


In the case where the data read is not OFFH, perform 
another erase operation. (Refer to Set-up Erase/Erase): 
Continue verifying from the address of the last verified 
byte. Once you have accessed the last address, erasure 
is complete and you can proceed to program the device. 
Terminate the erase verify operation by writing another 
valid command (e.g., Program Set-up). 


Set-up Program/Program Commands—40H 


Write this command (40H) twice in succession to initi- 
ate programming. The first write cycle sets up the de- 
vice for programming. The device latches address and 
data on the falling and rising edges of the second write 
cycle, respectively. It also begins programming on the 
rising edge. You stop the programming operation by 
issuing the Program Verify command, or by allowing 
the integrated program stop timer to time out. This 
timer works similiar to the erase stop timer. Again, a 
minimum specification replaces a tougher minimum/ 
maximum combination (10 s—25 ps). 


Program Verify Command—COH 


Flash memory devices program on a byte-by-byte basis. 
After each programming operation, the byte just pro- 
grammed must be verified. Write the Program Verify 
command (COH) to stop programming and set-up veri- 
fication. Should your software allow the integrated stop 
timer to halt programming, the software must resume 
the algorithm with the Program Verify command. The 
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device executes this command on the rising edge of 
Write-Enable. The program Verify command stages the 
device for verification of the byte last programmed. No 
new address information is latched. 


The flash memory applies an internally-generated refer- 
ence voltage to the addressed byte. Wait 6 ws for the 
internal voltages to settle before reading the data at the 
address programmed. Reading valid data indicates that 
the byte programmed successfully. 


Command Register Reset—FFH 


Flash memories reset to the read mode during power- 
up, and remain in this mode as long as Vpp is less than 
Vcc + 2V. If your system leaves Vpp turned-on dur- 
ing a system reset, then incorporate a command register 
device reset into the hardware initialization routines. 
This is necessary because the CPU might be controlling 
programming or erasure when the system reset hits. 


Write the reset command (OFFH) twice in succession 
to reset the device. The double write is necessary be- 
cause of the state-machine reprogramming structure. 
For example, suppose the system is reset after a Set-up 
Program command. The flash memory state machine 
expects the next write cycle to contain valid address 
and data for programming, followed by another write 
cycle for program verification. The first Reset com- 
mand will be mistaken for program data but will not 
corrupt the existing data. This is because the command 
(data = OFFH) is a null condition for flash memory 
programming. Only data bits programmed to zero pull 
charge onto the memory cell and change the data. The 
second write cycle actually resets the device to the read 
function. Following the second reset cycle, you can 
write the next command (Read, Program Set-up, Erase 
Set-up, etc.). 


If the Vpp supply is turned off upon system reset, the 
software reset is not required. The flash memory will 
reset itself automatically when Vpp powers down. 


Data Protection on Power Transitions 


The command register architecture offers another bene- 
fit in addition to simplified processor interface—during 
system power-up and power-down it protects data from 
corruption by unstable logic. Erasure or programming 
require Vpp to be greater than Vcc + 2V and the 
proper command sequence to be initiated. For example 
the CPU must write the erase command twice in suc- 
cession. The odds of this occurring randomly are slim. 
Additionally, should Vpp ramp to 12V prior to Vcc 
ramping past 2.5V, the device will lock out all spurious 
writes and internally block 12V from the flash memory 
cells. For even greater security, you can switch Vpp as 
discussed in Section 3.13. 
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2.3 Vpp Specifications 


Flash memories, like EPROMs, require a 12V external- 
ly-generated power supply for reprogramming. Intel’s 
Vpp specifications 12.0V +0.6V (5%) is compatible 
with most off-the-shelf (or available in-system) power 
supplies. (Note, Section 3.1 discusses Vpp generation 
techniques, and Appendix B shows different circuit al- 
ternatives.) 


It is essential to use the specified Vpp when reprogram- 
ming the flash memory device. Once the command to 
erase, program, or verify is issued, the device internally 
derives the required voltages from the Vpp supply. The 
command register controls selection of internal refer- 
ence circuitry tapped off of Vpp. An improper Vpp lev- 
el causes the references to be wrong, degrading the per- 
formance of the part. 


(When programming U.V. EPROMs, Vcc is raised to 
6.5V. On flash memories, the Vpp reference circuitry 
and command register architecture provide the same 
function while keeping Vcc and Vpp at static levels. 
An incorrect Vcc level during U.V. EPROM program- 
ming poses similar hazards to improper Vpp levels on 
flash memories.) 


The hardware design section discusses various methods 
for generating Vpp. 


3.0 HARDWARE DESIGN FOR ISW 


Covered in this section are the following: 


© Description of ISW-specific functional system 
blocks including memory requirements 


© Vpp generation techniques 
@® Communication Considerations 


ICATION 
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Figure 3. System Block Diagram 


System Level Hardware Requirements for ISW: 


@ processor or controller 


e limited amount EP/ROM or other flash memory 
devices for boot code, communications s/w, and re- 
programming algorithms 
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¢ limited amount of RAM for variable storage (i.e., 
stacks, buffers, and other changing parameters) 


e data import capability (i.e., serial line, LAN, floppy 
disk) 


e flash memory for nonvolatile code or data storage 
needs 


© Vpp generator or regulator 


All of the functional blocks in Figure 3 are typical of 
any embedded or reprogrammable system with the ex- 
ception of the Vpp generator. Some microcontrollers 
have on-chip EP/ROM, RAM and a serial port. With 
these devices, implementation of the ISW capability re- 
quires little additional hardware. 


The next section discusses Vpp generation techniques 
and communications design considerations. 


3.1 Vpp Generation 


A static Vpp is needed to reprogram flash memories. 
The Vpp voltage can be generated by: 


1) regulating it down from a higher voltage; 


2) pumping it up from a lower voltage (i.e., charge 
pump, DC/DC converter, etc.); or 


3) designing or specifying the system’s 12V supply 
with the required ISW tolerances and specifications. 


Sufficient current for reprogramming should be consid- 
ered when selecting your Vpp generation option. Paral- 
lel reprogramming for flash memory in 16-bit or 32-bit 
systems will require, respectively, 2X or 4X additional 
current capability. 


3.1.1 REGULATING DOWN FROM HIGHER 
VOLTAGE 


| Vpp is obtained from a higher voltage by using a linear 


regulator. Given the higher voltage, regulation offers 
the least expensive method of generating Vpp. Standard 
three terminal 12V +1%, +2%, +4% non-adjustable 
regulators are available off-the-shelf. Some regulators 
have on/off control built-in. (See Appendix B, Vpp Cir- 
cuit #1.) All regulators require a minimum input volt- 
age greater than the output voltage. (See Appendix B, 
Vpp Circuit #2 and #3.) 


3.1.2 PUMPING 5V UP TO 12V 


Vpp can be obtained by pumping Vcc and regulating it 
to the proper voltage. A voltage charge-pump can be 
designed and built by using a charge-pump integrated 
circuit and some discrete components (see Appendix B, 
Vpp Circuit #4) or by using a monolithic DC/DC con- 
verter (see Appendix A, Vpp Circuit #5). 


When using adjustable circuits containing discrete com- 
ponents, design the output voltage so it falls within the 
Vpp specifications for all corners of the components’ 
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skew (1.e., Voc +10%; Rx +1%, Ry +1%, etc.). In- 
clude the resistors’ temperature coefficients in the cal- 
culation matrix. Note that each of the various compo- 
nents can add error to the Vpp supply. 


The monolithic DC/DC converter shown in Appendix 
B Circuit #5 fits into a 24-pin socket. It offers the 
advantages of close temperature tracking and ease of 
implementation. It has also been characterized at tem- 
peratures and meets all the Vpp specifications. Appen- 
dix C contains a partial list of vendors selling DC/DC 
converters. 


Most DC/DC converters are only 50-60% efficient, so 
heat dissipation may be a concern. Some discrete boost 
circuits such as Appendix B, Circuit #4, offer much 
higher efficiency (70-85%). Circuit #4 as shown can 
supply 200 mA. Smaller inductor and capacitor compo- 
nent values and higher frequency boost convertors can 
be used where less power is required. For example, de- 
signs which reprogram one or two flash memories 
simultaneously might use the LT1172. (Contact Linear 
Technologies for more information.) 


In all Vpp generation methods, a capacitor on the input 
voltage terminals reduces the output noise voltage. 
Some power supplies (Appendix B, Circuits #3 and 
#4) specify a large-valued capacitor to decrease the Ef- 
fective Series Resistance (ESR). Place a 0.1 wF capaci- 
tor within 0.25 inches of each flash memory’s Vpp in- 
put (in addition the one on the Vpp generator’s input). 


NOTE: 
The ESR is inversely proportional to the capacitance 
value and the rated working voltage. To lower the 
ESR choose a capacitor with a large capacitance and a 
high working voltage (i.e., above 100V). 


3.1.3 ABSOLUTE DATA PROTECTION— 
Vpp ON/OFF CONTROL 


With Vpp below Vcc +2V or Vcc below 2.5V, 
internal circuitry disables the command register and 
eliminates the possibility of inadvertent erasure or 
programming. Switching the Vpp supply off pro- 
vides the secondary benefits of improved power and 
thermal management. 


There are two ways to switch Vpp on and off: 
1) directly switch the Vpp generator’s output, or 


2) switch the input voltage supplying the regulation 
circuit. 


Any switching circuit will cause a voltage drop, so 
choose a switch with this drop in mind. Some power 
supplies have asymmetrical tolerances on 12V (i.e. 
+ 5%, —49%). Flash memory allows the 12V supply to 
drop as low as —5%. The 1% difference between the 
supply and the device requirement allows the switch to 
have an ON resistance voltage drop of 0.12V. Continu- 
ing with this example, assume the system only repro- 
grams one flash memory at a time. The current through 
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the switch into the flash is Ipp = 30 mA. Solving for 
the allowable resistance across the switch: R = V/I = 
(0.12V)/(30 mA) = 4 Ohms. See Figure 4. Example 
Voltage Drop Across Switch. Note, one can reduce the 
effective Rps (ON) by placing 2 or more FETs in par- 
allel if necessary. 


12V=4% = 11.52V 


SWITCH Rps (ON) = 40 


Vpp = (12V=4%) = (30 mA)(4Q) 


Ipp = 30mA = 11.4V = 12V=-5% 


292046-38 
Figure 4 


Controlling the input voltage of a DC/DC convertor 
with a MOSPOWER FET is another straightforward 
approach. (See Appendix B, Circuit #5.) Choose the 
FET switch carefully. It should have a very low on-re- 
sistance to minimize the voltage divider effect of the 
converter and FET switch. If the voltage across the 
FET switch is too high, the converter will not have the 
proper input voltage to meet its specifications. Always 
design the switching circuit with sufficient margin to 
maximum Vpp and Vcc load currents. 


3.1.4 WRITES AND READS DURING Vpp 
TRANSITIONS 


After switching Vpp off, the CPU can read from the 
flash memory without waiting for the capacitors on 
Vpp to bleed off. To do this, write the Read Memory 
command prior to issuing the Vpp__OFF instruction. 
Alternatively, the device resets automatically to read 
mode when Vpp drops below Voc + 2V. 


Raising Vpp to 12V enables the command register. You 
must wait 100 ns after Vpp achieves its steady state 
value before writing to the command register. Remem- 
ber that the steady state Vpp settling time depends on 
both the power supply slew rate and the capacitive load 
on the Vpp bus. 


3.1.5 OTHER Vpp CONSIDERATIONS 


The Vpp pin is an MOS input which can be damaged 
by electrostatic discharge (ESD). In OBP applications, 
an external power source supplies Vpp and then is re- 
moved. Electrostatic charge can build up on the float- 
ing Vpp pin. You can solve this problem by one of two 
means: 1) tie the pin to Vcc through a diode and pull- 
up resistor (Figure 5a) or through a resistor to ground 
(Figure 5b). With either approach use a 10 KN or larg- 
er resistor to minimize Vpp power consumption. 


292046-7 
a. Vpp Tied to Vcc for OBP 


Vpp Pin 


292046-8 
b. Vpp Tied to Ground 


Figure 5 


NOTE: 
Typically EPROMs require Vpp to be within one di- 
ode drop of Vcc for optimal standby power consump- 
tion. Either approach can be used with the flash mem- 
ory. 


ISW applications do not require this ESD protection as 
most regulators and charge pumps contain a voltage 
divider on the output stage. A divider provides a resis- 
tive path to ground even with the supply turned off. 
(Note: check the schematics of the Vpp supply chosen.) 
However, if you directly switch the Vpp supply, add 
the resistor to ground; the switch isolates the Vpp pin 
and allows charge to build up. 


3.1.6 Vpp CIRCUITRY AND TRACE LAYOUT 


You should lay out Vpp circuitry and traces for high 
frequency operation since programming power charac- 
teristics exhibit an AC current component. Use the fol- 
lowing standard power supply design rules: 


© Keep leads as short as possible and use a single 
ground point or ground plane (a ground plane elimi- 
nates problems). 


¢ Locate the resistor network (or a regulator) as close 
as possible to the adjustment pin to minimize noise 
pick-up in the feedback loop. The resistor divider 
network should also be as short as possible to mini- 
mize line loss. 


© Keep all high current loops to a minimum length 
using copper connections that are as wide as possi- 
ble. (This will decrease the inductive impedance 
which otherwise causes noise spikes.) 


e Place the voltage regulator as close to the flash 
memory as practical to avoid an output ground 
loop. Excessive lead length results in an error volt- 
age across the distributed line resistance. 


© Separate the input capacitor return from the regula- 
tor load return line. This eliminates an input ground 
loop, which could result in excessive output ripple. 
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3.2 Communications—Getting Data to 
and from the Flash Memory 


The flash memory does not care about the origin of the 
data to be programmed. The data could be downloaded 
from a serial link, parallel link, disk drive, or generated 
locally as in data accumulation applications. 


While most systems communicate via serial link, send- 
ing a font to a printer’s flash memory is an example of a 
parallel interface. In either format, designers must de- 
cide whether or not to buffer the incoming data. Error- 
free serial protocols will require buffering for recon- 
struction of information packets. With equal capacity 
of RAM and flash memory in a system, the download 
time would only be limited by the speed of the commu- 
nication link. 


Both worst case and typical analysis must be done for 
real time download and un-buffered programming. The 
maximum transmission rate is 19.2K baud assuming 
worst case programming times. The time between char- 
acters at 19.2K baud is 520 ys; the worst case byte 
programming time is approximately 0.5 ms (including 
software overhead). Typical byte programming takes 
16 ws which allows for much higher unbuffered trans- 
mission rates. However, a single byte can take up to the 
full 400 ps specified time (plus software overhead), so 
you should not base transmission rate on typical pro- 
gramming times. 


Partial buffering or FIFO schemes can also be imple- 
mented to increase transmission rates. An argument for 
buffering is reduction of interconnect time and costs. 


4.0 SOFTWARE DESIGN FOR ISW 


Covered in this section are the following software re- 
quirements: 


® system integration of ISW 


® reprogramming considerations for single- and multi- 
ple-flash memory based designs. 


4.1 System Integration—Boot Code 
Requirements 


Boot code in remote systems should contain various 
ISW-specific procedures in addition to standard initiali- 
zation and diagnostic routines. 


The most dependable boot code for remote version up- 
dates contains some basic communications capability 
and the ISW reprogramming algorithms. Thus, a data- 
link disruption while reprogramming would be recover- 
able. For manufacturing flexibility, this boot memory 
could be an OBP 256K flash memory. 
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1. Bootstrap, and reset flash memory; 
. Check “HOST__INT” and “VALID__AP” 
flags: 
If HOST__INT is inactive and VALID__AP 


= 4150H, jump to application start address; 


. If VALID__AP<>4150H, loop and wait 
for host (the link probably went down during 
update); 

. When “HOST_INT” is active, vector to 
host interaction code. 


(See next section.) 


An alternative to storing these routines in a separate 
boot device is storing them in the flash memory con- 
taining the program code. Prior to erasure, the CPU 
would transfer the ISW routines to system RAM and 
execute from there. This type of approach is suitable for 
battery-operated equipment or systems with back-up 
power supplies. 


The communication link could be disrupted during re- 
programming, leaving the device in an unknown config- 
uration. Therefore, the boot code should reset the flash 
memory and check two ISW flags. The following sec- 
tion discusses the flag check concept. 


4.1.1 ISW FLAG CHECK 


After resetting the flash memories and initializing other 
system components, the CPU should check the com- 
munications link for a host interrupt. We will call this 
the HOST__INT flag. Had the communication link 
gone down prior to completion of downloading, then 
the host would have to re-establish contact to complete 
the task. 


Assuming no HOST__INT request has been made, the 
boot protocol then checks a data sequence in the flash 
memory signifying a valid application (VALID__AP). 
You program this sequence into the memory array after 
confirmation of a successful download. If a download is 
interrupted midway through erasure or programming, 
then the VALID__AP flag locations will not contain 
the VALID__AP code. On the next system bootstrap 
the CPU recognizes this and holds up system boot until 
valid code is programmed. In Figure 6 an example flag 
protocol uses the VALID__AP sequence of 4150H 
(ASCII codes for ‘“‘AP”’). 


4.2 Communication Protocols and 
Flash Memory ISW 


The remote download communications protocol must 
guarantee accurate transmission of flash memory in- 
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Figure 6. Example of ISW Integration to the Boot Sequence 


RESET FLASH 
MEMORY 


eas 


BEGIN MAIN 
APPLICATION 
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structions and program code. This protocol can be as 
simple as a read-back technique or as complex as an 
error-free transmission protocol. (See Figure 7 for pos- 
sible system-level flash memory instructions.) 


A simple read-back technique optimizes download for 
boot code memory needs and ease of implementation. 
The embedded CPU echoes the flash memory instruc- 
tion (i.e., Erase or Program) to the host, and waits for a 
confirmation prior to execution. After programming 
the update, the remote system checks the update by 
transmitting it back to the host for confirmation. The 
remote system then programs the VALID__AP se- 
quence. Note that programming and reading back 
64 Kbytes at 19.2K baud takes about 0.57 minutes per 
direction: 


(65,536 bytes) * (10 bits/byte) * (1 sec/19.2 Kbits) * 
(1 min/60 sec) = 0.57 minutes. 


Implementing either software- or hardware-based er- 
ror-free communications protocol improves transmis- 
sion efficiency. It eliminates the possibility of errant 
data being programmed if not buffered and checked, 
and optimizes the download process for transmission 
time. Additionally, file compression and decompression 
routines can improve the transmission rate. 


General ISW instructions include: 
STATUS CHECK 
INITIATE REPROGRAMMING 
MOVE ISW ROUTINES FROM FLASH MEMORY TO RAM 


(If not resident in separate boot memory) 
Data accumulation-specific commands include: 

RETRIEVE DATA 

ERASE FLASH MEMORY 


Figure 7. Sample System-Level 
ISW Instruction Set 


is 
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3 Status Check 


The host should request a status update from the re- 
mote system prior to sending a reprogramming instruc- 
tion. Depending on the response, the host may break 
the link and reconnect later, or it may send an erasure 
or data-upload command. This type of handshaking is 
necessary when system downtime for reprogramming 
might not be acceptable. An example of this is an auto- 
mated factory where robots handle caustic chemicals. 


4.3 Data Accumulation Software 
Techniques 


Data can be accumulated in a remote environment with 
flash memory and then uploaded to a host computer for 
manipulation. You can adapt various standard data- 
logging techniques for use with flash memory. With 
any technique, you determine the next available memo- 
ry location by reading for erased data (OFFH). This 
address would only be located once on system boot- 
strap and then recalled from RAM and incremented as 
needed. 


Given a repeating data string of known length and 
composition, program start and stop codes at either end 
of the string. Do not pick OOH or OFFH data for these 
codes because they are used during erasure. The start 
and stop codes enable the CPU to differentiate between 
available memory for logging and logged data equal to 
OOH or OFFH. 


For non-regular data input, you can address this same 
issue by programming the logged data followed by the 
variable identifier. Again, do not pick OOH or OFFH 
data for the variable identifiers. 


With any technique, the host computer separates and 
manipulates the data after the uploading operation. 


4.4 Reprogramming Routines 


Intel’s ETOX flash memories provide a cost-effective 
updatable, non-volatile code storage medium. The reli- 
ability and operation of the device is based on the use of 
specified erasure and programming algorithms. 


Intel offers reprogramming software drivers to make it 
easy for you to design and implement flash memory 
applications. The software is designed around the CPU- 
family architectures and requires minimal modification 
to define your system parameters. For example, you 
supply the memory width (8-bit, 16-bit, or 32-bit), sys- 
tem timing, and a subroutine for control of Vpp. 
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NOTE: 
Contact your nearest sales office for details. 


If you prefer to implement the algorithms yourself, they 
are outlined in the device data sheets. Command regis- 
ter instructions required for the various operations are 
included in the data sheet flow charts. 


The following sections describe both single-device and 
multiple-device parallel reprogramming implementa- 
tions. 


4.4.1 Quick-Erase Algorithm 


Flash memories chip-erase all bits in the array in paral- 
lel. The erase time depends on the Vpp voltage level 
(11.4V-12.6V), temperature, and number of erase/ 
write cycles on the part. See the device data sheets for 
specific parametric influences on reprogramming times. 


Note that prior to erasing a flash memory device the 
processor must program all locations to OOH. This equal- 
izes the charge on all memory cells insuring uniform and 
reliable erasure. 


Algorithm Timing Delays 


The Quick-Erase algorithm has three different time de- 
lays: 


1) The first is an assumed delay when Vpp first turns 
on. The capacitors on the Vpp bus cause an RC 
ramp. After switching on Vpp, the delay required is 
proportional to the number of flash memory devices 
times 0.1 4F/device. Vpp must reach its final value 
100 ns before the CPU writes to the command regis- 
ter. Systems that hardwire Vpp to the device can 
eliminate this delay. 


2) The second delay is the “Time Out TEW” function, 
where TEW is the erase timing width. The function 
occurs after writing the erase command (the second 
time) and before writing the erase-verify command. 
The erase-verify command or the integrated stop 
timer internally stops erasure. 


TEW for ETOX II flash memories is a minimum of 
10 ms. This delay can be either software or hard- 
ware controlled. Either way, the minimum nature of 
the timing specification allows for interrupt-driven 
timeout routines. Should the interrupt latency be 
longer than the minimum delay specification, the 
stop timer halts erasure. 


3) The third delay in the erase algorithm is a 6 ps time 
out between writing the erase verify command and 
reading for OFFH. During this delay, the internal 
voltages of the memory array are changing from the 
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erase levels to the verify levels. A read attempt prior 
to waiting 6 us will give false data—it will appear 
that the chip does not erase. Repeatedly trying to 
erase verify the device without waiting 6 ps will 
cause over-erasure. This delay is short enough that 
it is best handled with software timing. Again, note 
that the delay specification is a minimum. 


High Performance Parallel Device Erasure 


In applications containing more than one flash memo- 
ry, you can erase each device serially or you can reduce 
total erase time by implementing a parallel erase algo- 
rithm.’ You save time by erasing all devices at the same 
time. However, since flash memories may erase at dif- 
ferent rates, you must verify each device separately. 
This can be done in a word-wise fashion with the com- 
mand register Reset command and a special masking 
algorithm. 


Take for example the case of two-device (parallel) era- 
sure. The CPU first writes the data word erase com- 
mand 2020h twice in succession. This starts erasure. 
After 10 ms, the CPU writes the data word verify com- 
mand AOAOh to stop erasure and setup erase verifica- 


RAISE Vpp 


a 
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tion. If both bytes are erased at the given address, then 
the CPU increments the address (by 2) and then writes 
the verify command AOAOh again. If neither byte is 


erased, then the CPU issues the erase sequence again 
without incrementing the address. 


Suppose at the given address only the low byte verifies 
FFh data? Could the whole chip be erased? The answer 
is yes. Rather than check the rest of the low byte ad- 
dresses independently of the high byte, simply use the 
reset command to mask the low byte from erasure and 
erase verification on the next erase loop. In this exam- 
ple the erase command would be 20FFh and the verify 
command would be AOFFh. Once the high byte verifies 
at that address, the CPU modifies the command back 
to the default 2020h and AOAOh, increments the ad- 
dress by 2, and writes the verify command to the next 
address. 


See Figure 8 for a conceptual view of the parallel erase 
flow chart and Appendix D for the detailed version. 
These flow charts are for 16-bit systems and can be 
expanded for 32-bit designs. 


PROGRAM ALL DEVICES TO 00h 


RESET ALL VARIABLES 


ISSUE ERASE COMMAND 


TIME OUT 
VERIFY COMMAND 


BOTH DEVICES ERASED —N-> MASK* 
HI=OR LO=BYTE 
COMMANDS 


Y 
N 
LAST ADDRESS 
| Y 
DONE 


LAST PULSE s 


7 
ERROR 


* YOU MASK THE DEVICE BY SUBSTITUTING A RESET COMMAND 
FOR THE ERASE & VERIFY COMMANDS. THAT WAY THE 
ERASED BYTE IDLES THROUGH THE NEXT ERASE LOOP. 
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Figure 8. High Performance Parallel Erasure (Conceptual Overview) 


7. Parallel Erasure and Programming require appropriate choice of Vpp supply to support the increased power consumption. 
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4.4.2 Quick-Pulse Programming Algorithm 


Flash memories program with a modified version of the 
Quick-Pulse Programming algorithm used for U.V. 
EPROMSs. It is an optimized closed-loop flow consist- 
ing of 10 ws program pulses followed by byte verifica- 
tion. Most bytes verify after the first pulse, although 
some may require more passes through the pulse/verify 
loop. As with U.V. EPROMs, this algorithm guaran- 
tees a minimum of ten years data retention. See the 
device data sheets for more details on the programming 
algorithm. 


Algorithm Timing Delays 


The Quick-Pulse Programming algorithm has three dif- 
ferent time delays: 


e The first and third—Vpp set-up and verify set-up 
delays—are the same as discussed in the erasure sec- 
tion. In this case the third delay is for the transition 
between writing the Program Verify command and 
reading for valid data. 


Raise Vpp 
Get Address/Data Word 
Reset Command and 
Counter Variables 
Program Data 
Word 


Time Out 10 ps 


Stop Programming with 
Program Verify command 


More Data? 
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e The second delay is the “Time Out 10 ys” function, 
which occurs after writing the data and before writ- 
ing the program-verify command. This write com- 
mand internally stops programming. The section en- 
titled “Pulse Width Timing Techniques” gives 86- 
family assembly code for generating a 10 ps timer 
routine. 


High Performance Parallel Device Programming 


Software for word- or double-word programming can 
be written in two different manners. The first method 
offers simplicity of design and minimizes software over- 
head by using a byte programming routine on each de- 
vice independently. Here you increment the address by 
2 or 4 when addressing 1 of 2 or 4 devices, respectively. 
The second method offers higher performance by pro- 
gramming the word or double-word data in parallel. 
This method manipulates the command register in- 
structions for independent byte control. See Figure 9 
for conceptual 2-device parallel programming flow 
chart and Appendix E for the detailed version. 


Mask Hi or Lo Byte 


Write Read command Write Read command 


Lower Vpp 
Programming Complete 


Lower Vpp 
Program Error 
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*You mask the device by substituting a Reset command for the Program and Verify commands. That way, the pro- 
grammed bytes do not get further programmed on subsequent pulses. 


Figure 9. Parallel Programming Flow Chart (Conceptual Overview) 
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NOTE: 
Word or double-word programming assumes 2 or 4 
8-bit flash memory devices. 


Parallel Programming Algorithm Summary: 


® Decreases programming time by programming 2 
flash memories (16 bits) in parallel. The algorithm 
can be expanded for 32-bit systems. 


¢ Eliminates tracking of high/low byte addresses and 
respective number of program pulses by directing 
the CPU to write data-words (16-bit) to the com- 
mand register. 


¢ Maintains word write and word read operations. 
Should a byte on one device program prior to a byte 
on the other, the CPU continues to write word-com- 
mands to both devices. However, it deselects the 
verified byte with software commands. An alterna- 
tive is to independently program high and low bytes 
using hardware select capability. 


4.4.3 Pulse Width Timing Techniques 


Software or hardware methods can be used to generate 
the timing required for erasure and programming. With 
either method you should use an in-circuit emulator 
(ICE™) and an oscilloscope to verify proper timing. 
Also remove the flash memory device from the system 
during initial algorithm testing. 


Software Methods and Examples 


Software loops are easily constructed using a number of 
techniques. Timing loops need to be done in assembly 
language so that the number of clock cycles can be 
obtained from the instructions. 


In order to calculate a delay loop three things are need- 
ed— 


1) processor clock speed, 
2) clock cycles per instruction, and 
3) the duration of the delay loop. 


As an example, the 80C186 divides the input clock by 
2. With a 20 MHz input clock the processor’s internal 
clock runs at 10 MHz. This translates to a 100 ns cycle 
time. Delays can be made by loading the CX register 
with a count and using the LOOP instruction. The 
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LOOP instruction takes 16 clock cycles to execute per 
pass. It decrements the CX register on each pass and 
jumps to the specified operand until CX equals zero. 


When writing a delay loop consider all instructions be- 
tween the start and end of the delay. If a macro is 
written that delays 10 ys, add the clock cycles for all 
instructions in the macro. 


Here is an example of a 10 ys delay and the calculation 
of the constant required for a 10 MHz 80C186. 


WAIT_ 10 ps: 
push cx 
mov cx, DELAY 
loop $ 
pop cx 


310 clock cycles 
34 clock cycles 

see calculation 
310 clock cycles 


1. Start to End 


10 ps/cycle time 
10 ps/100 ns 


100 cycles 


100-24 cycles 
76 cycles 


. Loop Instruction 


+ 4g 
= (15 x [DELAY —1] + 5) 


3. Loop Cycles 


4. Solving for DELAY = 6 


Hardware Methods 


Using an Internal Timer— 


Many microcontrollers and some microprocessors have 
on-chip timers. At higher input clock speeds these in- 
ternal timers have a resolution of 1 ps or better. The 
timers are loaded with a count and then enabled. The 
timer starts counting and when it reaches the terminal 
count a bit is set. The CPU executes a polling algorithm 
that checks the timer status. Alternatively, a timer-con- 
trolled interrupt can be used. After the timer has been 
set and the interrupt enabled, the CPU can be pro- 
grammed to wait in idle mode or it could continue exe- 
cuting until the timed interrupt. 
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One thing to take into account when using interrupts is 
the time required for the CPU to recognize and inter- 
rupt request (interrupt latency). This is important when 
figuring the timer value, because the time seen by the 
part will be the programmed delay plus the minmum 
interrupt latency time. 


The 80C186 has three 16-bit timers on-chip. Timer #2 
can be a prescaler for the other two timers, which ex- 
tends timers #0 and #1 range out to 2432. By using 
two timers, 10 ys pulses and 10 ms pulses can be easily 
achieved. 


Using an External Timer— 


External timers can take many forms. One popular ex- 
ample is the 82C54 (CHMOS Programmable Interval 
Timer) which has three 16-bit timers on-chip. One tim- 
er can be used as a prescaler for the others so that a 
count of 2'32 can be achieved as with the 80C186 inter- 
nal timers. 


5.0 SYSTEM DESIGN EXAMPLE: 
AN 80C186 DESIGN 


A general purpose controller and/or data acquisition 
system was built to demonstrate 86-based ISW. The 
80C186 CPU drives the system, which contains 
16 Kbytes of EPROM (two 27C64’s), 64 Kbytes of 
flash memory (two 28F256A’s), 64 Kbytes of SRAM 
(two 32K x 8’s) three 8-bit ports (82C55A), one serial 
port (82510), and a 5V to 12.0V DC/DC converter. 
Three 74HC573’s demultiplex the address/data bus 
and latch the byte high enable line (BHE#) and the 
status lines (if needed). Two data transceivers 
(74HC245) simulate the worst case data path for a sys- 
tem requiring added drive capability. If the transceivers 
are not needed they can be replaced with wired headers. 
See Appendix F for detailed schematics parts list, and 
changes for the 28F512 or 28F010. 


The 80C186 reset (output) drives the reset input on the 
82510, 82C55A, and the OE# inputs on the address 
latches and data transceivers. The reset line goes inac- 
tive 5 clock cycles before the first code fetch. Also, the 
CPU’s write signal is split into byte-write-high and 
byte-write-low to allow for byte or word writes. 


The 80C186 has on-chip memory and peripheral chip 
selects. Two of the memory chip selects are dedicated. 
One is the Upper Chip Select (UCS#, dedicated for the 
boot area) and the second is the Lower Chip Select 
(LCS#, for the interrupt vector table area). See the 
memory map in Figure 10. 
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Initialize H/W, Comm, 
flash memory algo’s, etc. 
FCOOOH 


Version update code, 


Application Data Accumulation storage, 


etc. 


40000H 
Vector table, Stack, 


Buffers, etc. 
0000 


Figure 10. 80C 186 Memory Map 


The permanent code was placed in an EPROM in the 
UCS memory segment; this code includes routines for 
hardware initialization, communications, data upload- 
ing and downloading, erasure and programming algo- 
rithms, I/O drivers, ASCII to binary conversion tables, 
etc. This would be useful for systems reconfigured for 
different communication protocols as the last step prior 
to shipment. 


Code and constants that might change are placed in the 
64 Kbytes of flash memory. Application examples in- 
clude operating systems, code for rapidly advancing 
biomedical technologies such as blood test software, en- 
gine-control code and parameters, character fonts for 
printers, postage rates, etc. The RAM is used for the 
interrupt table, stack, variable data storage, and buff- 
ers. 


The three 8-bit ports on the 82C55A peripheral con- 
troller can be used for control and/or data acquisition. 
It powers-up with all port pins high. Similarly, all port 
pins go high after warm resets as well. Because the pins 
are high after a power-up/reset, an open collector in- 
vertor was used to control the MOSPOWER switch 
which in turn controls Vpp. You must drive the FET 
switch to one rail or the other to guarantee its low on- 
resistance. Vpp is turned off during power-up or reset 
as a hardware write protection solution. The DC/DC 
converter supplies Vpp. 


The 82510 is a flexible single channel CHMOS UART 
offering high integration. The device off-loads the sys- 
tem and CPU of many tasks associated with asynchro- 
nous serial communications. 
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The part can be used as a basic serial port for the host 
serial link, or can be configured to support high speed 
modem applications. For more information on the 
82510 see the 82510 data sheet and AP-401 “Designing 
with the 82510 Asynchronous Serial Controller”. 


Software was written to download code and data pa- 
rameters (code updates) from a PC to the demo board 
through the PC’s COM1 port (serial port). The system 
also can upload data (remote data acquisition) to the 
PC via the same link. 


Once the download code and data has been pro- 
grammed it can not be lost, even if power should fail. 
This is because Intel’s ETOX II flash memory technol- 
ogy is based on EPROM technology and does not need 
power to retain data. 


The end result: rugged, solid state, low power nonvola- 
tile storage. 
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6.0 SUMMARY 


Intel’s flash memories offer designers cost-effective al- 
ternatives for remote version updates or for reliable 
data accumulation in the field or factory. Designers will 
also benefit from time savings in any kind of code de- 
velopment—no 15 minute waits for U.V. EPROM era- 
sure. 


This application note covers the basics of in-system 
writing to flash memories and can be used as a check 
list for systems other than the 80C186 design shown. 
The basic concepts remain the same: a CPU controls 
the reprogramming operations; a 12V supply must be 
applied to the flash memory for erasure and program- 
ming; and a communications link connects the host to 
the remote system and supplies the code to be pro- 
grammed. 
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APPENDIX A 
ON-BOARD PROGRAMMING DESIGN 
CONSIDERATIONS © 
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INTRODUCTION 


On-board programming! (OBP) with Intel’s flash 
memory provides designers with cost reduction capabil- 
ities for alterable code storage designs. When used in 
conjunction with on-board programming, flash memo- 
ry presents opportunities for savings in two areas: 
greater testability in the factory, which translates to 
improved outgoing quality and reduced return rate; and 
quicker, more reliable field updates, which translates to 
decreased product support cost. 


a 
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This appendix: 


© outlines the design considerations associated with 
on-board programming, and the improvements af- 
forded by Intel’s flash memory; 


e offers guidelines for converting current 64K 
EPROM OBP designs; 


¢ designs an 8-bit system for on-board programming; 


© suggests some 16-bit flash design considerations; 
and offers information on OBP equipment and ven- 
dors. 


1. With on-board programming, non-volatile memory is programmed while socketed or soldered on the application board, 
rather than before hand as a discrete component. This programming method is also called in-module or in-circuit program- 
ming, and has been practiced by some major corporations since 1981. See sidebar on following pages for more information 


on U.V. EPROM OBP usage. 


HOST APPLICATION 
(Printer Shown Here) 


be pees ce eee cee ad 
AUUUNVIUNNLNILUOHULA AU 


BOARD-PROGRAMMER 


i 


Mi 
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On-Board Programming Manufacturing Example—A printer is customized via OBP for international markets: 
1. printer assembly completed, diagnostics code programmed and tested, and unit stored in inventory; 2. order 
arrives for printer with foreign language font; 3. diagnostics code flash-erased, and desired font programmed; 4. 


printer ships to customer. 


INTEL’S FLASH MEMORY—DESIGNED 
TO MEET YOUR OBP NEEDS 


Intel’s flash memory simplifies OBP code updates by 
offering designers the command register architecture. 
As described in section 2.2, this architecture offers the 
full reliability of EPROM off-board programming 
without the hassles of elevating Vcc. 


5 Voit Vcc Erasure and Programming 
Verification 


Unlike EPROM OBP, flash memory enables Vcc to 
remain at 5.0V throughout all operations. Internal cir- 
cuitry derives the erasure and programming verification 
levels from the voltage on Vpp rather than from Vcc. 
These verify modes enable use of a single Vcc bus for 
the entire board, as opposed to the two buses needed for 
U.V. EPROM OBP. (See sidebar entitled EPROM 
OBP). 
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REPLACING CURRENT EPROM OBP 
DESIGNS WITH FLASH MEMORY 


Hardware Considerations 


A slight hardware modification is required to adapt 
most of the current EPROM OBP designs for use with 
Intel’s flash memory. Simply convert the EPROM 
memory sites from 28 to 32 pins. All other board-de- 
sign cirteria used for EPROM OBP apply to flash 
memory as well. (For discussions of these criteria see 
section entitled New OBP Designs). 


Standard EPROM OBP requires the board designer to 
bus PGM # to the edge connector. With flash memo- 
ries’ command register architecture, this same trace en- 
ables electrical erasure and programming, only now the 
line is called Write Enable (WE#). The timing for 
WE # is similar to that of read accesses, although that 
is handled via software changes. 


Another potential hardware change is on the board 
programmer side of the design—the Vpp supply. Many 
EPROMs program with 12.5-13.0V Vpp supplies. In- 
tel’s ETOX II flash memory requires 11.4-12.6V Vpp. 
This change should not be an issue since the Vpp sup- 
ply on many board programmers is programmable. 


Mixed memory systems containing both conventional 
U.V. EPROM and flash memories require special con- 
sideration. This type of memory design requires separa- 
tion of the Chip Enable (CE#) control lines between 
the EPROM and flash devices to allow for independent 
reprogramming control and access. The PGM# and 
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WE# lines can be common if the board programmer 
can give the appropriate timings to either type of de- 
vice. 


Software Considerations 


Manufacturers who program EPROMs on-board today 
will need new board-programmer software to take ad- 
vantage of flash memory’s feature set, specifically soft- 
ware for the Quick-Erase and Quick-Pulse Program- 
ming algorithms. 


Benefits of Converting Your EPROM OBP 
Design to Flash 


The most pressing reason to convert from a standard 
EPROM to flash memory is the total cost savings. To 
appreciate this, you must consider your way of doing 
business at the board and system levels—from the fac- 
tory to installation and repair in the field. In the facto- 
ry, boards can be tested with a diagnostics program in 
the flash memory and then erased and reconfigured for 
shipment in the same step. Improved testing will de- 
crease the probability of field failures and costly cus- 
tomer returns. Simplified test and rework methods will 
decrease your inventory holding costs. Also, if in the 
process of converting to flash memory you include the 
ability to OBP via a cable-connector, service calls for 
code updates will be quicker, more reliable, and cost 
less money. Your serviceman would simply connect the 
programming equipment to the system without disman- 
tling it to remove the EPROMs. (See section entitled 
The System/Board-Programmer H/W Connection for 
details.) 
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NEW OBP DESIGNS 


Design Considerations 


As with EPROM in-circuit programming, flash memo- 
ry board programming requires the use of a board-pro- 
grammer. Unlike U.V. erasure for standard EPROM 
OBP, electrical erasure enables flash memory OBP 
without removing the board from the system. 


We will look at designing a board that is to remain pow- 
ered-up in the system during erasure and reprogram- 
ming. The key concept is to design the board in such a 
way that the programmer can take control of the system 
during code updates. The implementation of such a de- 
sign is straightforward, easy, and suited to automated 
production assembly. 


Taking Control 


The board-programmer needs to take control of the 
system’s address bus, data bus, control lines, etc. to 
update the code without damaging the system. (See 
Figure 2. System to Board-Programmer Interface.) 
Taking control simply means isolating the rest of the 
system from these lines. 


Various methods of isolating the memory from the sys- 
tem include using tristate buffers, latches, or even the 
capabilities designed into microprocessors (uP) and mi- 
crocontrollers (wC). For example, Intel’s 86-based wP 
family has HLD/HLDA signals that were set-up for 
multiprocessor system designs where bus control is a 
major concern. The HLD signal, when acknowledged, 
tristates the address, data, and control lines. Although 
not designed for multiprocessor environments, Intel’s 
MCS®-51 and MCS-96 microcontroller families have 
Reset capabilities to help simplify this same task. 
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One issue to be aware of when using a CPU’s reset 


control function is that it may switch from the reset to 
active condition at a non-standard logic level. This only 
presents a problem. if the address/data buffer takes 
longer to activate than the CPU, and the CPU attempts 
to fetch code from a memory device isolated from it. 


One approach to insure successful programming take- 
over (i.e. without bus contention) is to have the board- 
programmer’s lines in a high impedance state during 
connection to the system. Once connection to the sys- 
tem has been secured, the serviceman could hit a button 
on the board-programmer to start the system takeover 
procedure. Then when total control has been estab- 
lished, the programmer would commence with erasure 
and reprogramming. 


Aside from the flash device’s isolation from the system, 
various CPU control lines (MEMRD#, WE#, 
PSEN #, etc.) may need isolation as well. If active dur- 
ing Reset, these lines may put the CPU into an unspeci- 
fied state. When designing a board for OBP, check the 
C/P data sheets carefully for any special reset con- 
ditions. 


Printed Circuit Board Guidelines for 
Voc and Vpp 


Programming conventional EPROM and flash memo- 
ries takes 30 mA of current on Vcc and Vpp, due to 
the nature of hot-electron injection. Most of the charge 
transfers to the memory cell’s floating gate in a short 
current spike during the first pulse. You should design 
both the Vcc and Vpp traces with A.C. current spikes 
in mind. Wherever possible, limit the inductance by 
widening the two traces. Bypass capacitors (0.1 jF) 
should be placed as close as possible to the memory 
device’s Vcc and GND pins, as well as the devices Vpp 
and GND pins. The capacitor on Vcc decreases the 
power supply droop. The capacitor on Vpp supplies 
added charge, and filters and protects the memory from 
high frequency over-voltage spikes2. 


2. For a complete discussion of electrical noise, grounds, power supply distribution and decoupling see Ap-74—High Speed 
Memory System Design Using the 2147H, and AP-125—Designing Microcontroller Systems for Electrically Noisy Environ- 
ments. 
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NOTE: 


During normal system read operation, all interface traces are left open-circuited. Some of the lines have 
weak pull-ups to insure proper device operation. 


Figure 2. System to Board-Programmer Interface 
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The System/Board-Programmer Hardware 
Connection 


In most U.V. EPROM OBP applications, designers use 
the board’s edge-connector as the programmer inter- 
face. This approach is the lowest cost solution for stan- 
dard EPROM technology because U.V. erasable devic- 
es require system disassembly for erasure anyway. With 
flash memory, you can eliminate the system disman- 
tling and capitalize on the erase feature by adding a 
cable connector to the board for reprogramming pur- 
poses. The connector should extend from the board 
through the system’s chassis, and should be easy to 
reach by a serviceman. 


Various types of cables exist on the market that could 


be used to connect programming equipment to the sys- 
tem. The key design consideration when choosing the 
type of cable is elimination of all transient noise that 
would interfere with the programming or erasure pro- 
cess. 


Three types of noise interference and methods to dimin- 
ish the noise are as follows: 


1. line to line cross-talk (due to board-programmer’s 
drivers that drive sharp step functions on adjacent 
address lines); solved with either ribbon cables, hav- 
ing alternate lines grounded, or with braided twisted- 
pairs that have a ground line for each active signal; 


2. programmer line-driver-to-board impedance mis- 
matches leading to transmission line effects of signal 
reflection, and interference; solved by limiting cable 
length, decreasing programmer switching speed (or 
allowing longer settling time between address 
switches) or by using matched line drivers on the 
programmer and high impedance buffers on the 
board end, or by using series termination resistors on 
the driving end of the cable (i.e—board-programmer 
end, with the exception of the bi-directional data bus 
which needs series resistors at both ends); 


3. rf pick-up in electrically noisy environments; use ei- 
ther shielded cable such as coax, ribbon cable with 
solid copper ground plane, or a new type that has 
recently become available called Flex cable. 


Braided twisted-pair cables when kept under three feet 
in length generally reduce cross-talk to acceptable lev- 
els. This type of cable offers the most cost-effective so- 
lution which works well in most applications. Depend- 
ing on the environment, the programmer and your de- 
sign, you may need a combination of solutions, such as 
braided twisted-pairs with series termination. 
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At first all of these alternatives may seem expensive or 
superfluous, but keep in mind that the cost of a single 
cable and programmer gets amortized over the total 
number of systems programmed. 


AN 8-BIT BUS DESIGN EXAMPLE 


An example of an in-circuit reprogrammable controller 
board is an 80C31, two 28F256A’s and some glue — 
chips. (See Figure 3. for a system block diagram. See 
Appendix A. for a detailed system schematic.)3 The 
important issues for erasure and reprogramming are as 
follows: 


1. the board-programmer must have uncontested access 
and control of the flash memory array; and 


2. the microcontroller must be reset (un-active) during 
the erasure and programming cycles. 


SYSTEM DESIGN 


Bus Control Circuitry 


The 80C31 has an active-high reset pin, which tristates 
the address and data bases. Route this line (RESET) to 
the programming connector. Tie the OE# pins on the 
low-order address latch (74HCT573), and the PSEN # 
buffer-enable (74HCT125)4 together, and route that 
line MEMWRS to another pin on the programmer-in- 
terface connector. 


During normal system operations when the uC reads 
program code from the 28F256 devices, the pull-down 
on MEMWR keeps the address latches and PS9EN# 
buffer active. During flash memory OBP, the board- 
programmer drives MEMWR active-high, which dis- 
ables these outputs, and isolates the address bus and 
PSEN # from the programming signals. 


The board-programmer must independently control the 


RESET and MEMWR traces because they disable at 
different Vy; values (2.5V for RESET vs 0.8V for 
MEMWR). If controlled by the same 5V supply, on 
power-up or after a reset condition the wC would try to 
execute code while still isolated from its code source— 
specifically before the address latches and PSEN# 
buffer activate. 


Address Decode Circuitry 


This design shows two 28F256A flash memories. Sys- 
tems with more than one memory device typically de- 
code the CPU’s high-order address to select a particu- 
lar device. 


3. Note that the flow-through latch on the data bus is not needed with the 80C31, but is drawn as an example for CPU’s that 


can not tristate their data bus. 


4. The isolation buffer is required on PSEN# in this design because the 80C31 goes into unspecified states when the Reset 
and PSEN# lines are active simultaneously. To avoid any possible problems, buffer PSEN#. 
5. MEMWR = > bus isolation control of PSEN# and the data bus. 
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This is accomplished as illustrated. When A15 is low, 
the lower 32K bytes are selected. The output of the 
inverter drives the other 28F256A’s chip enable. This 
type of memory architecture promotes power savings 
by disabling all memories but the one being addressed. 


To accomplish this two-line memory control architec- 
ture, route the inverter’s input A15 to the 80C31 and to 
the programmer interface connector.8 The board-pro- 
grammer controls the inverter’s output enable with 
MEMEN#.?9 The MEMEN # line performs the func- 
tion normally performed by CE# in component pro- 
gramming. When driven to a logic “1” level 
MEMEN ¥ pulls the inverter’s output high. This dese- 
lects all memory devices controlled by that I.C. During 
normal read and standby operations, the pull-down on 
MEMEN #¥ keeps the decoder enabled. 


Erasure and Programming Control Circuitry 


In this design, Vpp and WE# are active only during 
reprogramming. At other times, the two inputs would 
be inactive. Simply tie the WE# line to Vcc through a 
pull-up resistor. The pull-up limits the current to the 
board programmer during reprogramming. (Recall that 
WE # is active low.) Flash memories allow Vpp to be at 
12V, Vcc or ground for read operations. This design 
ties Vpp to Vcc through a diode and resistor to allow 
for EPROM OBP compatibility. If this option is not 
required, simply tie Vpp to ground through a current- 
limiting pull-down resistor. 


Returning Control to the Host System 


The board-programmer should return system-control 
to the host processor in an organized manner. First it 
should lower Vpp from 12V to S5V, or ground. Then the 
board programmer should place its address and data 
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buses into a high impedance state. Next PS2, which 
controls MEMWR should be tristated thus disabling 
the PSEN # /Address latch isolation. Finally the board- 
programmer should switch PS1, which drives the RE- 
SET line to reactivate the wC. This sequence guaran- 
tees that the wC will begin operation at a known pro- 
gram code location. 


16-BIT BUS DESIGN 
CONSIDERATIONS 


An example of an On-Board programmable 16-bit sys- 
tem board would be an 80C186 microprocessor, two 
28F010 flash memories, RAM, and some glue chips. 
The basic hardware design considerations would be the 
same as those in the previously discussed 8-bit bus ex- 
ample. 


There are a few issues with 16-bit designs that do not 
arise in 8-bit designs. For the programmer to take con- 
trol of the system, it must tristate and reset the uP as 
well as tristate the bus buffers and latches. The HOLD 
and RESET lines of Intel’s 86-based family of micro- 
processors have been designed with bus isolation in 
mind for use in multiprocessor systems. 


The designer has two options for erasing and program- 
ming the high and low bytes of the flash memory array 
independently. 


1) The designer can route two WE# lines to the pro- 
grammer connector—BYTE HIGH WE# and BYTE 
LOW WE#. | 


2) The reprogramming software can follow the masking 
procedure shown in section 4.4. This method allows a 
common WE # line for the high and low bytes. 


8. Note the lack of isolation buffers between the 80C31’s high order addresses (Port 2) and the board-programmer interface, 
compared to the latch separating the low order addresses (Port 0) and the interface. In this design example, we make use of 
the 80C31’s ability to tristate these ports, so no isolation is needed for any of the addresses. The latch on Port 0 is for the 
time-multiplexed address/data architecture of this microcontroller, and not specifically for isolation. 


9. MEMEN = memory enable, active low. 
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Figure 4. Detailed 8-Bit Bus Design Schematic 
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OBP EQUIPMENT AND VENDORS 


If you are considering OBP for your next design, and 
have not used on-board programming before, you will 
need to choose a board-programmer vendor. Various 
suppliers offer OBP systems; therefore, it is well worth 
it to send out requests for programming support bids. If 
your production volume justifies the purchase of more 
than one board-programmer, you may want to negoti- 
ate a non-recurring engineering charge for development 
cost, followed by variable costs for additional units. 


Most vendors offer a variety of basic systems, designed 
to easily adapt to your needs. Systems can be purchased 
- that program either single boards serially, or a number 
of boards in parallel. Light-weight OBP equipment de- 
signed for field reprogramming can also be obtained 
from some of the vendors. 


Most companies will work directly with you at the be- 
ginning of your design phase to ensure OBP compati- 
bility. If your design is beyond the definition stage, the 
programmer manufacturer will request a copy of your 
schematics or block diagrams under non-disclosure. 
The vendor has an OBP design specialist that will 
check the design for OBP compatibility. Any potential 
problems will be located and corrected at this early 
stage. 


Every board’s architecture is different (i.e., based on 
different central processing units (CPU), decoding 
schemes, buffering methodologies, interface connectors, 
and types and densities of memories). Vendors write 
custom software modules for each application. Also, 
the vendor or the board designer typically builds an 
interface jig to connect the board’s edge connector to 
the programmer. This choice is often left as a decision 
for the designer. 
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Partial List* of Companies Selling 
Board-Programmers 


Following are a few of the companies who offer on- 
board programming solutions today: 


Data I/O Corp. 

Digelec 

Elan Digital Systems 

Oliver Advanced Engineering, Inc. 
Stag Microsystems, Inc. 


*This list is intended for example only, and in no way 
represents all companies that support on-board pro- 
gramming. Intel Corporation assumes no responsibili- 
ty for circuity other than circuitry embodied in an In- 
tel product. No other circuit patent licenses are im- 
plied. 


SUMMARY 


® On-board programming (OBP) has been around 
since 1981. 


e Designing a board for OBP can be easily done by 
working with a board-programmer vendor’s OBP- 
design-specialist during the initial design phase. 


e In-circuit alterable code storage can be easily imple- 
mented by using flash memory and it’s features. 


© Time and money savings can be realized in a num- 
ber of ways by taking advantage of flash memory 
OBP: 


<> Decreased board costs and improved reliability 
from elimination of EPROM sockets; 


<> Decreased manufacturing costs from elimination 
of board eraser depreciation costs, recurring U.V. 
light bulb and energy expenses; 


<> Decreased inventory expense from simplified test 
and rework methods (one-step diagnostics, era- 
sure, and board configuration); 


<> Decreased product costs based on decreased 
board-handling loss; 


<> Improved board diagnostics and testability leading 
to higher quality and decreased customer returns; 
and 


<> Quicker, more reliable field code updates. 
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APPENDIX B | 
Vpp GENERATION CIRCUITS 


Circuit #1—Regulation from a higher voltage 
Circuit #2—Regulation from a higher voltage 
Circuit #3—Regulation from a higher voltage 
Circuit #4—S5V to 12V Boost 

Circuit #5—SV to 12V Boost 

Circuit #6—Monolithic DC/DC Convertor 


For more detailed information on Vpp generation circuits, see AP-357 titled Power Supply Solutions for Flash 
Memory (Order Number 292092). 


Circuit #1 


Down Conversion 
(From 14.0V-—26.0V to 12.00V) 


LM2391CT 


Gnd 


| Vout = 1.20v (R1/R2 + 1) | 


292046-12 
COMPONENTS cosT* 


LM2391CT $0.75 
R1 = 20 KN, 1% 0.045 
R2 = 180 KO, 1% 0.045 
R3 = 10 KO 0.02 
C1 = 0.1 pF 0.02 
C2 = 100 pF 0.15 


$1.03 


NOTES: 

—The LM2391 offers an enable pin for added data protection. 
—The drop out voltage is 0.6V. 

—R3 is NOT required if Vpp enable is driven by a CMOS device. 
*Cost approximations assume 10,000 piece quantity. 
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Circuit #2 


Down Conversion 
(From 16.00V-26.00V to 12.00V) 


i" LM-317 


Out 
Voltage Regulator 
Adj 


292046-13 
COMPONENTS 


LM-317 

Ri = 1240, 1% 
R2 = 10709, 1% 
C1 = 0.1 pF 

C2 = 100 pF 


NOTES: 
LM-317 requires a minimum Vin-Vourt = = 3.0V 
*Cost approximations assume 10,000 piece quantity. 


Circuit #3 


Down Conversion 
(From 15.0V-—40.0V to 12.00V) 


292046-14 


COMPONENTS 


LT-1085 

Ri = 1240, 1% 
R2 = 10700, 1% 
C1 = 10 pF 

C2 = 10 pF 


NOTES: 
LT-1085 requires a minimum Vinj—Vout = 1.5V 
*Cost approximations assume 10,000 piece quantity. 
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Circuit #4 


Up Conversion 
(From 5V to 12.0V) 


MUR120 


1N5919A=5.6V  Vpp 


LT1072 200 mA MAX 
100 uF 
Vpp 


COMMAND 


Q1 
2N3904 
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COMPONENTS COST* 
LT1072 1.82 


R1 = 10.7k, 1% 0.045 Resistor 
R2 = 1.24k, 1% ee VppOUT Re olerined 


R3 = 1k, 5% 
R4 = 120k, 5% 0.02 
= 270k, 5% _ 0.02 | 

0.10 

0.10 

0.15 

1.00 


0.10 
$3.42 
NOTES: 


Drive Vpp COMMAND low to turn on the circuit. 
*Cost approximations assume 10,000 piece quantity. 
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Circuit #5 


Up Conversion Circuit 
(From 5.0V to 12.0V) 


Vpp Out 


Valor 
PM7006 


GND GND 


292046-16 


COMPONENTS COST* 


PM7006 $6.25 
C1 = 0.1 pF 0.05 
Buz11A 2.59 


$8.89 


NOTES: 

1. The capacitor decreases output noise to 140 mV ok-pk. 

2. We added the Buz11A Mospower nFET to enable/disable the converter. This control minimizes power consumption 
which under full load can reach 600 mA. 

3. The voltage drop across the switch is 0.1V. Due to this drop the PM7006 will not maintain the Vpp ety with 10% 
fluctuations in Voc supply. 

*Cost approximations assume 10,000 piece quantity. 
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APPENDIX C 
LIST* OF DC-DC CONVERTER COMPANIES 


AT&T MICROELECTRONICS* NATIONAL SEMICONDUCTOR CORP.A 


3000 Skyline Drive Mt. Prospect, IL 60056 ~ 
Mesquite, TX 75149 Tel: (800) 628-7364 
Tel: (800) 526-7819 Fax: (800) 888-5113 


Fax: (214) 284-2317 | 
: SHINDENGEN AMERICA, INC.t 


BURR-BROWN CORP.t 2649 Townsgate Rd., Suite 200 
P.O. Box 11400 Westlake Village, CA 91361 
Tucson, AZ 85734 Tel: (800) 634-3654 

Tel: (800) 548-6132 Fax: (805) 373-3710 


Fax: (602) 741-3895 
SILICONIX INC.A 


LINEAR TECHNOLOGY CORP.A 2201 Laurelwood Rd. 
1630 McCarthy Blvd. Santa Clara, CA 95056 
Milpitas, CA 95035 Tel: (800) 554-5565 
Tel: (408) 432-1900 : Fax: (408) 727-5414 


Fax: (408) 434-0507 
TOKO AMERICA, INC.t 


MAXIM INTEGRATED PRODUCTSA 1250 Feehanville Drive 
120 San Gabriel Drive Mount Prospect, IL 60056 
Sunnyvale, CA 94086 Tel: (708) 297-0070 

Tel: (408) 737-7600 Fax: (708) 699-7864 


Fax: (408) 737-7194 
VALOR ELECTRONICSt 


MOTOROLA INC.A 6275 Nancy Ridge Dr. 
2100 E. Elliot Rd. San Diego, CA 92121 
Tempe, AZ 85284 Tel: (619) 458-1471 


Tel: (800) 845-6686 


*This list is intended for reference only, and in no way represents all companies that support power conversion 
products. Since this industry develops many new solutions each year, Intel recommends that the designer contacts 
the vendors for the latest products. Intel will continue to work with the industry to develop optimum solutions for 
power conversion. Intel Corporation assumes no responsibilities for circuitry other than circuitry embodied in Intel 


products. No other circuit patent licenses are implied. 


‘ 
tMonolithic Solutions 
ADiscrete DC to DC Converter Solutions 
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APPENDIX D 
PARALLEL ERASE FLOW CHART 


COMMENTS 


START ERASURE 


APPLY Vppy Wait for Vpp to stabilize. 


Use Quick-Pulse Programming 
algorithm. 


Initialize Variables: 
INITIALIZE: PLSCNT_HI = HI Byte Pulse 

PLSCNT_HI =0 Counter ; 
she? Se =€ PLSCNT__LO = Low Byte Pulse 
LAG=0 
ADRS = 0 Counter 
E_COM = 2020H FLAG = Erasure Error Flag 
ae © PPPS ADRS = Address 

E__COM = Erase Command 

V__COM = Verify Command 


WRITE ADRS/E_COM 
Erase Set-up Command 


WRITE ADRS/E_COM > 
Start Erasing 


TIME OUT 10 mS ee 
Duration of Erase Operation. 


WRITE ADRS/V_COM Erase Verify Command stops 
erasure. 


DEVICE VERIFY & 
MASK ROUTINE See next page for subroutine. 


When both devices at ADRS are 

erased, F_DATA=FFFFH. 
F_DATA = FFFFH If not equal, increment the pulse 
. counter and check for last pulse. 


Reset commands to default 
RESET E_COM, V_COM (E_COM = 2020H, 
nr tance V__COM = AOAOh) 
before verifying next ADRS. 


INC ADRS, 
LAST ADRS? 


¥ 


WRITE READ_COM | : 
Reset devices for read operation. 
APPLY Vpp, Turn off Vpp 
ERASURE COMPLETE 
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Device Erase Verify and Mask Subroutine 


COMMENTS 


This subroutine reads the data word 
(F__DATA). It then masks the HI or 
LO Byte of the Erase and Verify 
commands from executing during 
the next operation. 


START SUBROUTINE 
TIME OUT 6 yS 
READ ADRS/F_DATA 


F_DATA =FFFFH 
? 


N 
LO_BYTE =(F_DATA AND OOFFH) 


If both HI and LO bytes verify, then 
return. 


Mask* the HI Byte with OOH. 


If the LO Byte verifies erasure, then 
mask* the next erase and verify 
commands with FFH (Reset). 


Y | E_COM=(E_COM OR OOFFH) 
V_COM =(V_COM OR OOFFH) 


If the LO Byte does not verify, 
increment its pulse counter and 
check for max count. FLAG = 1 
denotes a LO Byte error. 


INCREMENT PLSCNT_LO 


PLSCNT_LO = 3000d FLAG =FLAG # 1 
ee ap 


Repeat sequence for the HI Byte 


HI_BYTE = (F_DATA AND FFOOH) 


a Y | £_COM=(E_COM OR FFOOH 
agg eee V_COM ote oh OR sel 


INCREMENT PLSCNT_HI 


FLAG = 2 denotes a HI Byte error. 
FLAG = 3 denotes both HI and LO 
Byte errors. 


PLSCNT_HI = 3000d FLAG =FLAG # 2 
ere 


SUBROUTINE END 


292046-35 


NOTE: 
*Masking can easily and efficiently be done in assembly languages. Simply load word registers with the incoming flash 
data (F_.DATA), the erase commands and the verify commands. Then manipulate the HI or LO register contents. 
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APPENDIX E 
PARALLEL PROGRAMMING FLOW CHART 


. COMMENTS 
Start Program | 
Apply Vppy Wait for Vpp ramp to Vppy 


Get ADRS/P_ DAT ADRS = address to program 
— P__DAT = data word to program 


Initialize: Initialize Data Word Variables: 
PLSCNT__HI = 0 PLSCNT__HI = HI Byte Pulse 


PLSCNT__LO = 0 Counter 
FLAG = 0 PLSCNT__LO = LO Byte Pulse 


Counter 
V__DAT = P__DAT 
fate mae FLAG = Program Error Flag 
P_.COM = 4040H V__DAT = valid data 
V__COM = COCOH P_.COM = Program Command 


V__COM = Verify Command 


Write xx/P_COM Program Set-up Command 


xx = Address don’t care 


Write ADRS/V__DAT Program 
Time Out 10uS High/Low Byte See next page for subroutine 


Compare & Mask 


Write ADRS/V_COM Subroutine Progedmn Venti Gamimand 


Time Out 6uS 


Read ADRS/F_ DAT F__DAT = flash memory data 


Y 
Compare flash memory data 
to valid data (word compare). If not 
“> equal, check for program error 
F_DAT= P_DAT flag. If flag not set, compare High 
and Low Byte in subroutine. 
N 


Y 


9 
“N 


Write READ COM Write READ COM Z 
Reset device for read operation. 
Apply VppL Apply Veet 
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Check buffer or I/O port for 
more data to program. 


Turn off Vpp. 


in AP-316 
2 . 
Program Verify and Mask Subroutine 


COMMENTS 


START SUBROUTINE To look at the LO Byte, mask* 
the HI Byte with 00. . 


LO_BYTE =(F_DATA AND OOFFH) 


LO_BYTE= P_COM =(P_COM OR OOFFH) cs 
(V_DATA AND OOFFH) V_DAT = (V_DAT OR OOFFH) If the LO Byte Verifies, mask 
? V_COM = (V_COM OR OOFFH) the LO Byte commands with 


the reset command (FF). 


INCREMENT PLSCNT_LO If the LO Byte does not verify, 
then increment its pulse 
counter and check for max 
count. FLAG = 1 denotes a 
LO byte error. 


Repeat the sequence forthe 


HI_BYTE= P_COM = (P_COM OR FFOOH) 
(V_DATA AND FFOOH) V_DAT = (V_DAT OR FFOOH) 
? V_COM = (V_COM OR FFOOH) 


INCREMENT PLSCNT_HI 


FLAG = 2 denotes a HI Byte 
error. FLAG = 3 denotes both 
HI and LO Byte errors. FLAG 


= 0 denotes no max count 
errors; continue with algorithm. 


SUBROUTINE END 
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NOTE: 
*Masking can easily and efficiently be done in assembly languages. Simply load word registers with the incoming data 
(F-DAT), the program commands and the verify commands. Then manipulate the HI or LO register contents. 
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APPENDIX F 
DETAILED SYSTEM SCHEMATICS 
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RESET# 
27 

OE# 

WR LOW# 


35 JRESET# 


82C55A 
[15] 


DC/DC 
5/12.00+5% 
{16] 


GND}12 
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256K FLASH MEMORY DEMO PARTS LIST 


Bl a Es Description 


[1] 80C186 16-bit high integration CPU 
[2,3,4] 74HC573 Latch 
[5,6] 74HC245 Transceiver 


[7] 
[8L,8H] 
[9L,9H] 


[10L, 10H] 


[11] 
[12] 
[13,14] 
[15] 


74HC32 
27C64 


28F 256A 
32K x 8 SRAM 


82510 
14C88 
14C89 
82C55A 


OR gate 

16 Kbyte EPROM 

64 Kbyte flash memory 

64 Kbyte SRAM 

Asynchronous Serial Controller — 
RS-232 Line Driver 

RS-232 Line Receiver 
Programmable Peripheral Controller 


[16] PM7006 DC/DC Convertor (5V-12.00V) 
[17] 7406 Invertor—Open Collector (O.C.) 

C1 20 uF Capacitor for CPU reset 

D1 1N914 Diode for CPU reset 

F1 BUZ11A MOSPOWER nFET 

J1 DB-25 Connector (male) 

OSC-1 20 MHz CPU Oscillator 

OSC-2 18.432 MHz Serial Controller Oscillator 

R1 10 KO U/W, 10% Resistor for CPU reset 
R2 1K /4W, 10% Resistor for O.C. pull-up 
SW1 Momentary Push Button for CPU reset 


NOTES: 
1. Place a 0.1 uF bypass capacitor at the Voc input of each IC. 
2. Place a 0.1 uF bypass capacitor on the Vpp input of each 28F256 flash memory. 


298F512 UPGRADE FOR THE 2. Change the MCS individual block-select size from 


64 Kbytes: 
80C186/FLASH MEMORY DESIGN cms Watine = 41F8H, 


To upgrade the 80C186/Flash memory design to han- MPCS_VALUE = OAOB8H 
dle 28F512’s, the range of the CE# signal has to be to 128 Kbytes: 

increased. There are a number of ways to generate a MMCS__VALUE = 01FEH, 
CE# signal that will span the 128 Kbyte address range MPCS__VALUE = OCOBEH 


of two 28F512 devices. Also, cut the CE# trace to the RAM sockets. Then 
1. AND two of the current MCS lines together (defined wire MCSO# to the RAM CE#. This eliminates the 
for 64 Kbytes each); or MCS0O# and LMCS# range overlap caused by in- 


creasing the MCS range to 128 Kbytes. See 80C186 
Data Sheet page 21 and 22 (Order # 270354). 
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28F010 UPGRADE TO THE 
80C186/FLASH MEMORY DESIGN 


To upgrade the 80C186/flash memory design to handle 
28F010’s, a CE# signal has to be generated. There are 
a number of ways to generate a CE# signal that will 
span the 256 Kbyte address range of two 28F010 devic- 
es. 


1, AND two of the MCS lines together (defined for 128 
Kbytes each as noted in the 28F512 modifications): 


Cut the LMCS trace to the RAM sockets. Connect 
MCS0O# to CE# on the RAM sockets (U10L,UH). 


Cut the MCS2# trace to the flash memory. Add an 
AND gate. Connect MCS2# (cut trace) and 
MCS3 # to the inputs of the AND gate. Then wire 
the AND gate output to the CE# of the flash memo- 
ries. 


Also, change the onboard memory MCS register to: 
MMCS__VALUE=01FEH, MPCS__ 
VALUE= O0COBEH [128K blocks], 


and delete: 
LMCS__REG and LMCS__ Value. 


2. Add a decoder; 


Add a decoder (74HC138). Connect address lines 
A18 and A19 to the B and C inputs of the decoder. 
Tie the A input of the decoder low, and enable all the 
enables. By using outputs YO, Y2, Y4, and Y6, you 
have four CE# lines decoding 256 Kbyte blocks 
each. 


Cut the MCS2# trace to the flash memories. Con- 
nect the Y2 output from the decoder to the CE# 
input of the flash memory. 


intel. 


. Replace the address latch (U2) with a PLD that 


latches and decodes. 


Program a 5C032 as an integrated latch and decoder. 
Replace the upper address latch [U2] with the Intel 
5C032 EPLD. Cut the CE# trace to the flash mem- 
ories. Connect the flash memories’ CE# to the 
5C032 pin 12. This maps the address space 40000H 
to 7FFFFH. See Figures 1 and 2 for a comparison of 
the 74HC573 (U2) and programmed 5C032 pin outs. 
Figure 3 is the source code for the EPLD. 


Also, change the value of the MMCS and MPCS 
registers to 64 Kbyte blocks so that the MCSO# 
range does not overlap the LMCS range. 
MMCS__VALUE=41F8H, MPCS__ 
VALUE= OAOB8H. 


U2 


74HC573 15 (7 LBHE# 
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Figure 1. Latch Pinout 


EPLD 5C032 15/(C]LBHE# 
14) CE# (40000H-OBFFFFH) 
13 [CJ CE# (80000H-OBFFFFH) 
12) CE# (40000H-7FFFFFH) 
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Figure 2. Integrated Latch and Decoder 
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Thom Bowns = PLFG Applications 
Intel 

January 13, 1989 

EPLD HOTLINE: 1-800-323-EPLD 
002 

5C032 

Custom Latched Decoder 
OPTIONS: TURBO=ON 

PART: 5C032 


INPUTS: ALE@11, RESET@1, A19@5, Al8@4, A17@35, Al6@2, nBHE@6 


OUTPUTS: LA18@17, LA17@18, LA16@19, LnBHE@15, nCES@14, LA19@16, 
nCE2@15, nCE1@12 


NETWORK : 

ALE = IN (ALE) 

RESET = INP (RESET) 

nRESET = NOT (RESET) 

Al9 = INP (A119) 

Ale = INP (A418) 

ALT <= 

AL6 = 
nBHE = 
LA19, LA19 
LA18, LA18 
LA17, LA17 
LA16, LA16 
LnBHE, LnBH 
nCE3, nCE3 
nCE2, nCE2 
nCEl, nCEl 


(LA19d, nRESET) 
(LA18d, nRESET) 
(LA17d, nRESET) 
(LA16d, nRESET) 
= COIF (LnBHE, nRESET) 
COIF (nCE3, nRESET) 
COIF (nCE2, nRESET) 
COIF (nCEl, nRESET) 


Hud Su iu te ul 


EQUATIONS: 
LA19d 
LA18d 


Al9 * ALE + LA19 'ALE ; 

Al8 * ALE + LA18& !ALE ; 
LA17d = Al7 * ALE + LA17 'ALE ; 
LA16d = Al6 * ALE + LA16 * !ALE; 
LnBHEd = nBHE * ALE + LnBHE * !ALE; 
nCE3d = nCESEQN * ALE + nCES * !ALE; 
nCE2d = nCE2EQN * ALE + nCE2 * !ALE; 
nCEld = nCElLEQN * ALE + nCEl * !ALE; 
nCE2ZEQN = !(A19 * !A18) ; 

nCELEQN = !(!A19 * A118) ; 

nCESEQN = !(!A19 * A18 + Al9 * !A18) ; 


Figure 3. Source Code for the Integrated Latch and Decoder 
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INTRODUCTION TO 
REPROGRAMMING 


You Are in Control 


Rewriting any type of memory requires hardware or 
software control. Traditional EEPROM designers com- 
bined all control functions into each chip’s periphery. 
This provided a highly functional chip but at a high 
price. On the other hand, DRAM designers provided a 
bulk memory with little integrated peripheral circuitry. 
Each system designer then accommodated the DRAM 
with external refresh signals and learned quickly that 
failure to refresh yielded non-functioning memory 
boards. Initially, software drivers controlled DRAM 
refresh; today controllers provide the same function. 


Similarly, early disk drives required every user to write 
software to manipulate drive head movement. Failure 
to follow drive specifications and algorithms caused ir- 
reversible head crashes. Leading-edge engineers faced 
these challenges and triumphed, as evidenced by the 
sophisticated systems available today. 


Since 1988, thousands of engineers have written soft- 
ware to direct flash memory reprogramming. With first 
generation flash memories, one sends a control signal to 
a device to begin and end programming or erasure. It is 
a simple process implemented on more than 40 million 
units, however care must be taken. If algorithms are 
not properly followed, a device may be rendered inop- 
erable. This document discusses proper software and 
debug technique, which yields dependable first genera- 
tion flash memory operation. First generation products 
include the 28F256A, 28F512, 28F010 and 28FO020. All 
second and third generation Intel Flash Memories con- 
tain automated program and erase routines. 


FUNDAMENTALS OF FLASH MEMORY 
OPERATION 


Adaptive vs Brute Force Algorithms 


Many designers use EPROMs regularly. Few consider 
the programming algorithms because the PROM pro- 
grammer vendors take care of that function. 


Two types of algorithms are in use today: 
e Adaptive Algorithms 
© Brute Force Algorithms 


Adaptive algorithms such as Intel’s Quick-Pulse Pro- 
gramming and Quick-Erase algorithms reduce pro- 
gramming time. A feedback mechanism recognizes 
when each byte has been programmed sufficiently. You 
may ask how is the point of sufficiency determined? 
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ee 
intel ; 
One simply adds the net effects of Vcc and tempera- 
ture variations, and superimposes on those factors the 


normal EPROM charge leakage to obtain the answer. 
The next question is how can these factors be checked? 


| NOTE: 
EPROM and EEPROM charge leakage occurs over a 
very long time—typically 100 years. Reliability papers 
often discuss charge leakage in terms of the memory’s 
data retention characteristic. 


If you look at EPROM programming algorithms, you 
will notice that Vcc is elevated during programming. 
The elevated Vcc acts as the feedback mechanism for 
the adaptive algorithm. Reading the device and check- 
ing for program completion is called verification, or 
margining. (One is checking the margin to Vcc fluctua- 
tions.) For example, if the part can be verified at 6.25V, 
then it can withstand the fluctuations and normal 
charge leakage. 


During the past few years most major EPROM manu- 
facturers have converted to adaptive algorithms. The 
algorithm loops back and programs a byte again if the 
first program operation does not verify at the elevated 
voltage. 


Brute force algorithms simply program each byte mul- 
tiple times, typically with long program durations. This 
type of algorithm has no in-system margin verification. 
That is they assume but never verify program margin to 
the typical environment effects. 


Many flash memories that specify a brute force algo- 
rithm may fail to retain data for 10 years. Additionally, 
they may not read the data correctly even at specified 
Vcc and temperature extremes. 


Intel’s flash memory program and erase algorithms are 
both adaptive. They offer margin verification without 
requiring users to elevate Vcc in-system. When issued 
a command to program verify, the memory’s command 
register logic taps an internally-generated elevated Voc 
from the user-supplied external Vpp (12V). This is why 
it is essential that you provide the specified Vpp voltage 
and follow the given adaptive algorithms. Intel’s adap- 
tive algorithms, combined with the command register 
architecture, assures reliable code and data storage and 
dependable system operation. 


Figure 1 shows an example of an adaptive byte pro- 
gramming algorithm. Appendix A compares the algo- 
rithm in Figure 1 to a brute force approach. 


Program Verify= 
Read Data 


from Device ° 


Y 
Program 
Error 
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Y 
Program 
Success 


Figure 1. The flow chart shows the fundamental 
nature of an adaptive algorithm. Based on the 
outcome of program verification, the flow may 

_ loop back for another program operation. 


Moving Charge and Other Factors You 
Should Know 


This section discusses the mechanics of flash memory 
programming. For most system designers, transistor- 
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level discussions were last heard in college. We may 
recall that DRAM consists of a storage capacitor and a 
transistor. We remember this clearly because failure to 
refresh that capacitor causes systems to malfunction. In 
like fashion, one should understand the fundamentals 
of flash memory reprogramming. The understanding 
will enable error-free memory operation and reliable 
system performance. 


In simplest terms, each data bit equates to a memory 
cell. Intel’s flash memory uses one transistor per cell 
with the smallest possible architecture. This delivers 
the lowest cost per bit and highest capacity, levering 
system software (rather than bulky, complex cells) for 
reprogramming control. 


Figure 2 shows a simplified cross section of Intel’s flash 
memory transistor. Note the structure; the cell is a 
stacked gate MOS transistor. An isolated floating gate 
stores the memory charge. The floating gate consists of 
a layer of (conductive) polysilicon surrounded by (non- 
conductive) oxide layers. 


On a DRAM cell, each transistor connects to a capaci- 
tor which stores the memory charge. The major differ- 
ence between flash memory and DRAM derives from 
their cell structure. The DRAM cell loses its charge if 
not refreshed within a few milliseconds. On the other 
hand, the flash memory floating gate maintains its 
charge for typically 100 years. The structure is isolated 
and insulated by the field and gate oxides—hence the 
name “‘floating”’ gate. 


ETOX Flash Memory Cell* 


Control Gate 
Floating Gate 


Substrate 


292059-2 
*Patented Intel Processes 


Figure 2. Simplicity of design assures increasing densities, manufacturability and reliability. 
These are the attributes that drive mainstream memories. 
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Changing the memory contents is simple. Figure 3 
shows two memory cells—one being erased and one 
being programmed. Erasure removes charge from all 
bits simultaneously. Programming adds charge to se- 
lected bits. During erasure, not all charge is removed. 
The erase verify operation tells the system when 
enough charge has been removed. At that point, the 
flash memory behaves like a U.V.-erased EPROM. 


Removing too much charge by erasing too long renders 
the memory unprogrammable. Excessive erasure lowers 
the cell threshold to the point where the transistor is 
always on and always reads data “1”. (Recall that the 
cell threshold, V;, determines when the transistor turns 
on or off.) You must control the erase timing within the 
algorithm specifications on first generation flash mem- 
ories. 
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A second erase consideration relates to the first. Prior 
to erasing the chip, you must blanket program all bytes 
to data 00h, regardless of the previous data. This step 
equalizes the charge on all transistors. 


If you skip this step and proceed directly to erasure, an 
interesting thing happens. Consider a typical byte pro- 
grammed with data OAAh (1010 1010b). While pro- 
gramming this data, bits with data “1” remain erased 
(charge removed), and bits with data “0” are pro- 
grammed (charged added). Following programming, 
normal read operations sense whether a memory tran- 
sistor has more or less charge and drives the outputs 
accordingly. 
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Erasure 
Removes Charge from Floating Gate 


292059-3 
Field from Vg, forces electrons from floating gate. 


Programming 
Adds Charge to Floating Gate 


292059-4 
Vgs > V¢ turns transistor on creating source-drain channel (Igs); 
Field from Vgq attracts electrons from channel current towards floating gate. 


Figure 3. Flash memory cells during erasure and programming. Note the 
movement of charge on and off the floating gate. The charge adjusts the 
cell threshold, which tells the outputs whether a bit (transistor) is on or off. 
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Erasure then removes charge from all bits. The bits that 
have had charge added (data “0”) have some quantity 
of charge removed; bits with less charge (data “1’’) 
have charge removed as well. This is akin to excessively 
erasing the data “1” bits. Pre-programming all bits to 
data “0” equalizes the charge which allows for con- 
trolled, uniform erasure of all bits in the device (i.e., all 
1,048,576 bits in a 28F010). 


The sections entitled “Margin for Error” and the 
“Erase Algorithm Interpreted, Program all Bytes to 
00h” discuss this concept in greater detail. 


ERASURE—THE GOLDEN RULE 


Erasure removes charge from all memory cells in paral- 
lel. This lowers the cells’ threshold voltages from the 
programmed level (6.5V) below Vcc to the erased level 
(3.2V) The device continues erasing until told to stop 
by the verify command or until the integrated stop-tim- 
er counts down. 


Margin for Error 


Allowing erasure to continue too long depletes the 
charge in floating gates. So you ask—how long is too 


Typical 
» Program Level 


CELL 
THRESHOLD 
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long? Figure 4 shows the margin for error of a typical 
device. Following the algorithm would have stopped 
erasure after 1 second. Cell depletion occurred after 10 
seconds giving a 10x margin for error. This 10x margin 
exists if the erased cell erases in 1 second or 10 seconds 
(i.e., within the algorithm limits). This chart shows one 
typical example where the device happened to take 1 
second to erase. 


Flash memory has generous margin for error over the 
stopping point defined by the algorithm. The stopping 
point is defined as the point when all bytes in the chip 
verify to FFh data. The erase operation duration 
(Twhwh2) is specified at 10 ms + 500 ps. Five hun- 


- dred microseconds offers substantial allowance for sys- 


tem latency during erasure and even for slop in the 
timer generation. Processors or controllers can execute 
many lines of code in 500 jus, and the margin for error 
simply adds another guardband. 


Proper software and system design will never rely on 
the additional margin for error. Remember, you control 
the program code and system operation during erasure. 
Once you have fully debugged your driver code, the 
issue of software control disappears entirely. 


ERASE TIME 
MARGIN FOR ERROR 
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Figure 4. The logarithmic-decaying nature of erasure allows for 10x 
error in erase time before a device becomes inoperable. Remember, 
each device has its own erase time, thus the use of an adaptive algorithm. 
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Most Common Development Issues 


Having covered the fundamentals of flash memory re- 
programming, let’s move on to the system’s hardware 
and software perspectives. The following list of ques- 
tions might have occurred to you... 


® You have defined a system power supply with regu- 
lated 5V and 12V outputs (Vcc and Vpp). Due to 
the smaller capacitive load on the Vpp supply, Vpp 
powers up much faster than the Vcc supply. Will 
this affect the device? 


© How does the flash command register architecture 
reset? 


© Suppose your code sends a signal to start erasure, 
and never tells it to stop? 


e Suppose your software delay timers are not calibrat- 
ed. Instead of stopping erasure after ten millisec- 
onds, the code issues the stop command after 10 
seconds? 


e Suppose your 6 us timer used between the erase and 
erase verify modes is only 2 ps? 

e Suppose you decide to skip the first erase operation 
(program all bytes to zero) because the device is al- 
ready programmed with data? 

@ Suppose you are programming and erasing devices 
in a 16- or 32-bit system? 


The answer to all these questions can be found in the 
following sections. The questions and the reasons all 
relate to the discussion of how the cell works. 


Device Initialization and Reset 


Many logic devices which contain command or control 
registers also have a reset pin. This pin serves two pur- 
poses: it resets the device’s internal logic; and it syn- 
chronizes the device’s clock to the system clock. 


Intel’s first generation flash memory command register 
and reprogramming circuitry reset to the read mode by 
three means: 


1. raising or lowering Vpp with Voc = 5V; 

2. raising Voc with Vpp = 12V; 

3. issuing the reset command twice in succession. 
NOTE: 

Method 3 stops erasure or programming as well as re- 

sets the chip. 


A few cases require closer consideration. 
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Case 1. The System Controls Vpp with a Switch 


Assuming Vcc is stable with Vpp switches on, then the 
command register defaults to the read mode. No pow- 
er-on reset is required. 


Designers might opt to include the Vpp switch for 
either (or both) of two reasons. The first reason is pow- 
er minimization. Depending on the technology used, a 
voltage regulator or pump’s efficiency can range from 
40% -85%. Switching off the Vpp supply minimizes 
system power consumption. See Appendix B for an ex- 
ample Vpp generation circuit with ON/OFF control 
capability. 


The second reason is absolute data protection. This fea- 
ture is not available to 5V-only EEPROM because the 
reprogramming voltages are generated internally. On 
that class of memory device, logic glitches can spuri- 
ously change data during system power up or power 
down. Flash memory’s 12V power requirement offers 
absolute control over these concerns; with Vpp below 
Vcc + 2V, data protection is guaranteed. Internally, 
the electric fields are simply too weak to spuriously 
write data. 


Case 2. Vpp Powers Up before Vcc 


Systems with Vpp hardwired to a regulated transformer 
might encounter this case. Typically, Vcc will charge 
many more bypass capacitors than Vpp. Vcc will 
therefore power up much more slowly. 


The flash memory power-down (Vcc = OV) default 
state blocks Vpp from disturbing the array. These con- 
ditions hold while Vcc is below ~ 2V. Once Vcc rises 
above ~ 2V, the internal logic kicks in and resets the 
device to the read mode. (This is analogous to the inter- 
nal Vpp reset condition described in Case 1.) 


Should the three control pins glitch during the power- 
up phase (CElow, WElow, and OEhigh), then the com- 
mand register acts to filter the data. The command port 
will only react to the correct command sequence. 


Designers might opt to hardwire Vpp for a number of 
reasons. The first reason is cost minimization. A regu- 
lated 12V secondary from a transformer is commonly 
available. Adding a switch or a power supply sequencer 
adds cost and complexity. The second reason involves 
consideration of the end application. Using the flash 
memory as a read/write memory requires optimization 
for the write cycle. Powering Vpp on before each write 
would waste considerable time. 
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Apply Standby Wait for Vpp Ramp to 
Vppy (= 12.0V)(1) 


Use 
Program All 

Quick=Pulse 
Bytes to OOH Programming 


Use Quick-Pulse 
Programming 


Initialize Addresses, 
ADDR = OOH Erase Pulse Width, and 
TEW = 10ms Pulse Count 

PLSCNT=0 


Write E a i 
Setmis Chad Write Data = 20H 


Write Data = 20H 


Standby Duration of Erase 
Operation (Twhwh2) 


Verity Grd Write Addr = Byte to Verify; 
Data = AOH; Stops 
Erase Operation 
Standby tWHGL 
Read Read Byte to Verify 
Erasure 


Standby Compare Output to 
Y FFH, Increment Pulse 


Count 
Increment Last 7 
Address Address? 


Y 


Write 
Write Data = OOH, Resets 


the Register for Read 


Apply Apply | Operations. 


Wait for Vpp Ramp to 


Vpp 1(1) 
Erasure 
Cz: 


292059-6 
NOTES: 
1. The Vpp power supply can be hard-wired to the device or switchable. When Vpp is switched, Vpp 1 may be ground, 
no-connect with a resistor tied to ground, or less than Voc + 2.0V. 
2. Erase verify is performed after chip-erasure. A final read/compare may be performed (optional) after the register is 
written with the read command. 
3. CAUTION: The algorithm MUST BE FOLLOWED to ensure proper and reliable operation of the device. 


Figure 5. Quick-Erase Algorithm for Intel’s First Generation Product Line 
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Case 3. Warm Resets 


Warm resets, where the system maintains power while 
rebooting, requires closer inspection. Consider the situ- 
ation where the system is reprogramming the flash 
memory and a hardware or software reset occurs. 


The boot software would not realize that programming 
or erasure is ongoing and would not know to stop the 
reprogramming operation. Therefore safeguard against 
this condition with one of two means: 1) ensure that 
control logic switches Vpp off during reset; or 2) reset 


the flash memory before resetting the processor. For a 


software reset, simply add the flash memory reset com- 
mand to the interrupt sequence. For hardware resets, 
wire the reset switch to the interrupt controller instead 
of directly to the reset input. Hardware resets would 
then execute the software interrupt sequence. Intel’s 
second and third generation flash memories all include 
a H/W reset pin (RP#) formally called PWD#. This 
pin is essential for any device with automation or em- 
bedded algorithms. 


_ The Erase Algorithm Interpreted 


The following section offers a block by block explana-. 


tion of the Quick-Erase algorithm shown in Figure 5. 
Understanding the reasons behind a function will en- 
able you to appreciate the importance of following the 
algorithm explicitly. Deviations will negatively affect 
the part’s performance and should not be attempted. 
Note: the effect may not be immediately apparent. 


Apply Vppy (Optional, see Discussion on Device Ini- 
tialization) 

Switch on the local Vpp supply prior to erasure and 
programming. The time required for Vpp to reach its 
steady state 12 + 0.6V depends on the capacitive load 
and the impedance of the printed circuit board trace. If 
you measure this delay on a wire-wrapped prototype 
system, remember that temperature, printed circuit 
traces and the board’s layout change the load seen by 
the Vpp generator. Allow Vpp sufficient time to ramp 
before proceeding with the next step. 
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Program All Bytes to 00h —> Data = 00h? 


Prior to erasure, blanket program all addresses in the 
flash memory to 00h (charge state), regardless of the 
previous data. Verify that each address equals 00h be- 
fore proceeding to the next address. If you use only part 
of the memory array, you still need to pre-program the 
entire array for erasure. An example where this is an 
issue is using a 512K in a 256K socket. A second exam- 
ple is a system where internal microcontroller memory 
overlaps the external flash memory space. 


Programming data O0Oh equalizes the charge on every 
bit in the array. This is necessary because erasure re- 
moves charge from all cells regardless of their previous 
state. 


For example, reconsider the byte containing AAh data 
(1010 1010b). If you skip the pre-program step, then 
during erasure when the data “0” bits get charge re- 
moved, the previously erased bits (data “1’’) lose addi- 
tional charge. This drives the cell threshold a little low- 
er. The next time you erase the chip and change the 
code, the threshold will drop to 2.8V. 


If the memory transistor is not pre-programmed to data 
“Q” before the next erasure, then its threshold will drop 
on successive reprogramming cycles (denoted by E3, 
E4, etc. in Figure 6). Repeated violations of the blanket 
programming requirement drives the threshold to the 
point where the transistor is stuck on (data = “1”’). 


Variable Initialization 


Initialize two variables and a constant: ADDR (ad- 
dress), PLSCNT (pulse count), and TEW (erase pulse 
width). The pulse count increments from 0 to a maxi- 
mum of 1000 erase tries. The erase pulse width remains 
constant at 10 ms. The address increments from the 
flash memory starting address to the ending address 
during verification. 
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Figure 6. Successful erasure requires blanket programming all bytes to 
the data “0” level first. This prevents threshold decline on successive erase 
cycles (E2, E3, etc.). Very low thresholds cause the chip to malfunction. 


Write Erase Set-Up Command 


Write the erase set-up command (20h) to any flash 
memory address. This prepares the selected device for 
erasure, but does not activate the process. A second 
erase command (20h) is required. Any other data writ- 
ten to the flash memory between the set-up and erase 
commands will abort the sequence. Once the process is 
started, it will not stop until told to do so. The correct 
stop erasure command is Erase Verify (AOh). However, 
any command including the Reset command is an ille- 
gal sequence and will stop erasure as well. 


Write Erase Command 


The erase command starts the erase process. Internally, 
the device switches the voltages on all memory cell 
drains, gates, and sources to the erase configuration. 


Time Out Tew (10 ms) 


Start your software or hardware timer. Until com- 
manded to verify or until the integrated stop-timer 
counts down, the flash memory continues the erase pro- 
cess. Therefore, assign a high priority to the timer in- 
terrupt. If a higher priority interrupt occurs, stop the 
erase process and switch contexts (store all variables, 
registers, etc.). This will allow reentry into the erase 
procedure in a controlled fashion. 
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Write Erase Verify Command 


Write the erase verify command (AOh) to the flash 
memory at the address given by the ADDR variable. 


The erase verify command performs many tasks. Inter- 
nally, the device stops erasure and latches the given 
address for verification. Additionally, the command 
changes the voltages on the memory cell drains, gates 
and sources to the erase verify configuration. 


Time Out 6 ps 


This time out accounts for the internal slew rate of 
switching the memory array from the erase to the erase 
verify configuration. Do not attempt to read from the 
device before 6 jus has passed; the device will appear to 
still be programmed. This is because you have not al- 
lowed sufficient time for the memory to change config- 
urations. Your code will then interpret this as a need 
for extra erase operations, and will continue erasing the 
device. 


NOTE: 
6 ws is a minimum specification. You can use the 
10 ps timer developed for the programming algo- 
rithm. 


a a 
intel. 
Read Data from Device 


Read the data at the address given by the ADDR vari- 
able. This should be the same address driven with the 
erase verify command. 


Data = FFh? 


Compare the output data at address ADDR to FFh. If 
the data equals FFh, then that address has been erased. 
Continue verification until the last address has been 
verified or until the maximum erase pulse count (1000) 
has been reached. Typically, most devices will fully 
erase within 50-100 erase loops. 


Last Address — Increment Address 


Check the ADDR variable to see if the last address has 
been verified. If not, increment the ADDR variable and 
re-write the erase verify command. Remember to write 
the erase verify command to address ADDR, since the 
verify command latches the address. Also, if your sys- 
tem has 64K byte segment boundaries, be sure to incre- 
ment the base pointer every 64K byte addresses. 


Write Read Command 


After full chip verification, write the read command 
(OOh) to switch the device to read mode. If you plan to 
reprogram the device immediately, this step is not nec- 
essary. 


Apply Vppy; (Optional) 


Switch Vpp off. With Vpp left on, the command regis- 
ter offers data protection by requiring a precise se- 
quence to initiate programming or erasure. However, 
Vpp controls overall command register operation. 
Turning Vpp off disables the command register, thus 
providing absolute data protection. Without the high 
voltage, the reprogramming mechanisms cannot occur 
and the component becomes a read only memory 
(ROM). 


Abort/Reset 


Whenever a system error condition occurs (reset or re- 
boot), write the Reset command (FFh) to each flash 
memory twice in succession. This is a good initializa- 
tion practice in systems leaving Vpp at 12V. The proc- 
essor would be unaware if prior to the reset, it had been 
in the middle of erasure, and this sequence aborts era- 
sure. 


The Program Algorithm Illuminated 


The full algorithm will not be interpreted here, al- 
though a few items should be noted. You can find a 
conceptual version of the Quick-Pulse Programming al- 
gorithm in Chapter 2, Figure 1, and the complete flow 
chart in Appendix C. 
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First, similar to erasure, a two-write sequence starts 
programming. The first write is the Program Set-Up 
Command which primes the chip for programming. 
The chip then latches the address and data to be pro- 
grammed on the second write. You can abort program- 
ming by writing the Reset Command twice in succes- 
sion instead of the data to be programmed. 


Second, the device continues programming until com- 
manded to stop by the Program Verify Command. 
Similar to the Erase Verify Command, this command 
performs a couple of functions. Internally, it halts pro- 
gramming and latches the given address for verifica- 
tion. Additionally, the command changes the voltages 
on the memory array’s drains, gates, and sources to the 
program verify configuration. 


The cell programming mechanism is self-limiting. 
However, do not assume that programming all twenty- 
five 10 us operations in one pass is the best way to 
attain reliable operation. To a certain degree, program- 
ming stresses the memory cell. The stress is considera- 
bly lower than that applied to EEPROM (2 MV/cm 
lower to be specific). But why stress a component with- 
out cause? The adaptive Quick-Pulse Programming al- 
gorithm with its fast program operations, minimizes all 
stresses and affords the greatest reliability. 


Finally, after writing the Program Verify Command to 
the device, wait a minimum of 6 ps before reading the 


device. The time out accounts for the internal slew rate 


of switching the memory array from the program to 
program verify configuration. Do not attempt to read 
from the device before 6 us has passed; the device may 
appear unprogrammed. Your code will then interpret 
this as a need for extra program operations. It may 
needlessly reach the 25 operation limit, even though the 
byte most probably programmed on the first pass. 


Ramifications of the Golden Rule 


Always follow the erase command with an erase verify 
command to stop erasure. Interrupt-driven systems 
must give high priority to servicing the reprogramming 
timer interrupts. Systems that reset upon a watchdog 
time-out must reset the flash memory device before re- 
booting. (See discussion on device initialization.) Like- 
wise any non-maskable interrupt should software- or 
hardware-reset the flash memory before performing a 
context switch. 


Use an oscilloscope to calibrate all time delays before 
attempting erasure. The delay modules include the 
6 ps, 10 ys, and 10 ms timer routines. 


Blanket program all addresses to 00h data before eras- 
ing. Verify correct implementation of the programming 
algorithm with a PROM programmer before attempt- 
ing erasure. (Chapter 4 explains how this can be done.) 
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16- and 32-bit systems require special attention. Each 
flash device has its own erase characteristic. Do not 
assume that if the low byte of a data word is not erased, 
then the high byte must not be either. 


Always follow the listed guidelines and take care while 
developing your code to eliminate the erase control 
issue. Consider it similar to implementing any control 
function. Once the code is debugged and stable, the 
issue goes away. 


You might ask, is it not possible to control erasure 
through hardware? The alternative to software control 
is integrated hardware control or an external controller. 
Intel ofers a complete line of high density, cost-effective 
products with integrated hardware control, often called 
automation. Whether software or hardware controlled, 
Intel’s ETOX Flash Memory offers the most reliable, 
- dense, manufacturable, and fastest read/write nonvola- 
tile memory. Other EEPROM approaches have draw- 
backs of multiple transistors per memory cell. This 
property negatively affects all those attributes offered 
by Intel’s ETOX flash memory. 


DEBUGGING YOUR CODE AND 
OTHER TIPS ON TESTING 


As with any software checkout, a few simple principles 
enable complete flash memory algorithm debug. The 
following sections offer some hints to make your job 
easier. 


Software Drivers Save You Time 


Intel saves you time by offering various processor-fami- 
ly flash memory drivers. You simply edit the files to 
suit your system. Then assemble the driver, link, and 
locate it, and you are ready for debug. 


_ These drivers offer the framework for successful flash 
memory reprogramming, and require some customiza- 
tion to fit your particular system. If your processor’s 
driver is not available, you may use the available driver 
software as an example. One caution in advance: The 
drivers have been written in assembly language to give 
the most speed- and memory- efficient code. However, 
most people prefer high-level programming. 


High-level programming can be used for everything ex- 
cept software-timer generation. Compilers may give 
different routines with different object code on each 
compilation. Therefore, the timers must be either hard- 
ware-based or coded in assembly language. Software 
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timers also present some risk if there is a frequency 
upgrade change on the controlling processor. Regener- 


ate and check your timer routines whenever the system 
clock rate changes. : 


Timers, Test Loops and Assembly 
Level Programming 


Timing circuits or software play the most crucial role in 
flash memory reprogramming. Good timers precisely 
control their function; sloppy timers produce faults. An 
example of a sloppy timer is one produced by a compil- 
er. Each time high-level languages recompile, the low- 
level object coding may change. Thus, a timing loop 
may be 10 ms one compilation, and much longer or 
shorter the next time. 


You can check your timing method with the following 
simple technique. Develop test loops which call the var- 
ious timers’ routines. For example, implement the 6 ps, 
10 ps, and 10 ms timers used with the 28F512 and 
28F010. If you have a spare port or peripheral output, 
use it to trigger an oscilloscope. Follow the trigger call 
with the timer routines. If you do not have a spare port, 
write to the flash memory address space before and 
after each timer call. You can trigger the oscilloscope 
off of the flash memory CE# signal. Remember to 
power-down the system and remove the flash memory 
before attempting these methods. 


Once the timer code has been verified, you can link and 
locate it to a higher-level erase/program algorithm im- 
plementation. 


Programming—The Key to Proper 
Erasure 


Earlier sections described the importance of program- 
ming 00’s prior to erasure. This procedure equalizes the 
charge on all memory cells; following this step all bits 
erase in unison. 


A conclusive debug technique can check your program- 
ming software. Simply use your software to program 
zeroes into the flash memory and then verify this step 
using a conventional PROM programmer. Load the 
PROM programmer’s buffer with all zeroes and com- 
pare the buffer to the flash memory. If your program- 
mer does not service the flash memory, call the compa- 
ny for the latest software upgrade. Alternatively, one 
can easily rig the 512K flash memory to look like a 
512K EPROM. Simply jumper Vcc on a 32-pin socket 
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to a few pins. Note that the 27512 EPROM and 
28F512 flash memory have different intelligent identifi- 
er codes. Override the identifier code check to use this 
method. See Figure 7 for socket details. 


Some microcontrollers have limited address space or 
internal memory that masks certain external address 
space. Even if you do not use sections of the flash mem- 
ory, you must still access these sections to program ze- 
roes before erasure. Map and decode port bits to access 
unused address space, and verify that all bytes are pro- 
grammed to zero before proceeding with erasure. 


28F512 (64K X 8) 


27512 (64K X 8) 


292059-8 


Figure 7. A 28F512 can be read in a PROM 
programmer as a 27512 by jumpering the 
appropriate pins to Vcc. The same method 
applies to the 28F010. 


16- and 32-Bit Systems— 
Achieving Optimum Reprogramming 
Throughput 


Erasing flash memory in 16- and 32-bit systems re- 
quires special consideration. One could implement the 
program and erase algorithms in a byte-wise fashion, 
but this is time-consuming. Alternately, one can treat 
the multiple flash memory as a data word, and gain 
optimum performance. 


The primary consideration with the latter approach is 
that one device may program or erase faster than the 
other(s). Subsequent programming or erasure of a slow- 
er device compromises the functionality of the faster 
device by subjecting it to the slow-device timing. 


Consider an example of erasure in a 16-bit system. Af- 
ter 10 passes through the erase operations, both devices 
verify through address 07C3h. Then at address 07C5Sh, 
the processor reads data word 83FFh. 


Since erase data is FFFFh, a few bits in the upper byte/ 
device have not erased. The natural flow of the algo- 
rithm would dictate another erase operation. But what 
about the lower device? Could it be completely erased? 
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Of course it could be; every device erases at a different 
rate and the algorithm has only checked up to address 
07C5h. 


You can take advantage of the data rate of wider data 
buses by utilizing the command register, the reset com- 
mand and an analysis of erasure. Each erase operation 
is 10 ms. Each byte verification takes 6 ss. Therefore, 
erasure takes three orders of magnitude longer than 
verification. Optimization for erasure yields the opti- 
mum performance because verification is a second 
order effect. 


Let us reconsider the previous example. At address 
07C5h, the data word does not verify. On the next erase 
operation edit the erase (and erase verify) command 
word such that only the high byte gets the erase com- 
mand, and the low byte gets a reset command. (i.e., 
change the command word from 2020h to 20FFh). 


See Application Note AP-316 for a detailed flow chart 
for this approach. Note this document is based on the 
28F256; however, most concepts carry through to the 
higher density devices. (Literature Order number 
292046). 


Logic Analyzers and In-Circuit 
Emulators 


Many programmers use logic analyzers and in-circuit 
emulators to debug code. These approaches are fine for 
flash memory algorithm debug if certain conditions are 
met. 


1. Check timing routines with an oscilloscope; there is 
no alternative. 


2. Know your code and set breakpoints intelligently. 
One designer had the bad luck of throwing in a 
breakpoint in the middle of the program 00’s loop. 
After stepping through a couple of byte program 00 
loops, he called the erase flow routine. Can you iden- 
tify the problem? 


3. Single step through your reprogramming code, if and 


only if, the flash memory device is removed from the 
system. 


Testing Your Software—One More 
Time 


Some flash memories specify 100 erase/program cycles. 
This is a minimum specification; Intel Flash Memories 
cycle 100,000 times. With this in mind, feel free to 
check and recheck reprogramming operations. There is 
no reliability risk in doing so. 
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One confidence-raising test is similar to that done on 
systems: stress the system/software by executing test 
code numerous times consecutively. Set the reprogram- 
ming drivers in a loop, and let them run 20—40 times. 
On each consecutive pass, use a constant data pattern 
such as OAAh. This tests the reprogramming code from 
a quasi-static perspective. Missing is the true system 
environment. In the true system environment, multiple 
inputs compete with the flash memory for interrupt pri- 
ority. Also, RF noise from motors can cause spikes and 
glitching on Vpp or Vcc. Additionally, fully loaded 
systems or partially loaded systems might have differ- 
ent Vpp response characteristics or noise levels. Signals 
that look clean in the lab, might not be all that clean in 
the true operating environment. Therefore, flash repro- 
gramming tests should be done in the true system envi- 
ronment as a final test. 
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Watchdog Timer Debug Circuit | 


This section describes a simple tool you can build for 
debugging your code. Since Intel’s first generation 
Flash Memories contain integrated stop-timers, this 
tool offers no real benefit. It is simply shown in case a 
designer is debugging code for alternate sources. An 
EPLD watches the flash memory data bus and control 
signals for the erase sequence—erase set-up, erase, and 
erase verify commands. Once the CPU initiates erasure, 
the debug tool starts a 15 ms timer. Should the timer 
count down prior to receiving the erase verify com- 
mand, then the circuit switches Vpp off. 


This tool does not check for the other items discussed 
in the Tips on Testing section; you must still check 
those yourself. 


Figure 8 shows the circuit schematic. The EPLD 
source code and the name of an Intel EPLD applica- 
tions engineer is located in Appendix D. 


Voc 
LED 


SAC312 
(EPLD) CLK 
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Figure 8. Watchdog Timer Debug Circuit 
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TROUBLE SHOOTING GUIDE 


Determining the Root Cause— 
Software Error vs Device Damage 


The three major indications of a flash memory problem 
are labeled in the following section. The subsequent 
paragraphs define potential root causes to investigate. 


I. The Device Does Not Program 


- Did it program before? 
A. No. 


1. 


Trigger your oscilloscope on CE# while prob- 
ing Vpp. Verify that Vpp has reached a steady- 
state 12V when the device is first written. 


. Set the time-base to 10 ps/division (the dura- 


tion of the program operation). Trigger on 
CE# and probe WE# (look at both traces). 
Check the duration of the 10 ws program oper- 
ation time delay. Also, check the duration of 


the 6 us delay between writing the program ~ 


verify command and read. 


. Look for ringing on Vpp when Vpp has been 


switched on. Over-voltage stress on Vpp (ring- 
ing with amplitude greater than 13V) will de- 
stroy Vpp’s silicon structure. 


. Power the system down and back up. Look for 


destructive glitches on Vcc or Vpp (greater 
than 7V and 13V respectively). 


. Verify erasure and programming on a PROM 


programmer (if available). Fill the programmer 
buffer first with 00h data and program the buf- 
fer to the flash memory. Then erase the device, 
and repeat with AAh data. Repeat the last step 
with 55h data. This sequence fully exercises the 
array, the input buffers and the output buffers. 
If all tests pass then check for a hardware or 
software error. 


II. 
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B. Yes. 


1. Have you done anything that may have ESD 
zapped the devices (i.e., touched the devices 
while not being grounded, re-wired the proto- 
board with the components socketed, etc.)? If 
yes, check part as outlined in section 1.A.5. 


2. Have you attempted erasure? If yes, verify 
your algorithm as outlined in Chapter 4. Also, 
implement the in-system intelligent identifier 
mode. If the device outputs an incorrect code, 
then either an output has been zapped or the 
golden rule has been violated. Section 1.A.5 
describes a method of checking for ESD dam- 
age. 


The Device Does not Erase 
Did it erase before? - 
A. No. 


Follow steps 1-5 outlined in section I. When 
performing step 2, adjust the oscilloscope time 
base to 10 ms/div. 


B. Yes. 
Has the board design, clock rate or software 
changed? System clock rates directly affect the 


accuracy of software timers. See AP-316 for a 
discussion on software timing versus clock rate. 


III. The Device Erases Spuriously 


Exercise all system functions while monitoring the 
flash memory chip selects. Verify that I/O mapped 
addresses or logic are not accidentally selecting the 
flash memory. For example, the space bar charac- 
ter sent from a keyboard controller happens to be 


_ 20h. If the flash memory is accidentally selected 


while this data is on the bus, then erasure will com- 
mence on the following cycle when the condition 
occurs again. 
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APPENDIX A 


TWO APPROACHES TO ALGORITHMS 


Adaptive Brute Force 
Program 


Program Verify~ 
Read Data 
from Device 


Program 100 us 


Y 


Time Out 1.5 ms 


N 


Program Program 
Success Error 
292059-11 


0 Efficient— 0 Slow— 

Max Time = (10 + 6 ps) « 25 Max Time = (100 ps * 12) + 3 ms 
= 400 ps = 4200 ps 
= (10 + 6 ps) + 1 Typ Time = (100 us « 10) + 1.5 ms 
= .16 ps 2.5 ms 
O Reliable— O Questionable— 


Verify Command slews internal voltages to simu- Unknown margin to Vcc and temperature 
late elevated Vcc. swings, aS well as cell leakage. 


Typ Time 


Figure 9. Left and right flow charts compare intel’s (adaptive) Quick-Pulse Programming 
algorithm and another company’s (brute force) approach to flash memory programming. 
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APPENDIX B 


MUR120 


INS919A=5.6V  Vpp 


DO OUTPUT 
200 mA MAX 


Vpp 
COMMAND 
* 


| 12.0V | 10.7k | 1.24% | 1% 
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Figure 10. Basic flash memory Vpp voltage supply with ON/OFF control. | 
When Vpp COMMAND goes low, the Linear Technology LT 1072 switching regulator produces 12V. 
This circuit is just one example of a Vpp supply. 
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APPENDIX C 


QUICK-PULSE PROGRAMMING ALGORITHM 


Start 
Programming 
Apply 
VppH [1] 
PLSCNT =0 


Write Set-up 
Program Cmd 


Write Program 
Cmd (A/D) 


Valid Address/Data 


Duration of Program 
Operation (twHwwH1) 


Write Program 
Verify Cmd 


Time Out 6us 


Read Data 
from Device 


Y 
Last 
Address? 


Y 
Write 
Read Cmd 
Apply Apply 
Vppz [1] Veet [1] 
Programming Program 
Completed Error 
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Increment 
Address 


NOTES: 
1. The Vpp power supply can be hard-wired to the device or switchable. When Vpp is switched, Vpp | may be ground, 
no-connect with a resistor tied to ground, or less than Voc + 2.0V. 

2. Program Verify is only performed after byte programming. A final read/compare may be performed (optional) after the 
register is written with the Read command. 

3. CAUTION: The algorithm MUST BE FOLLOWED to ensure proper and reliable operation of the device. 
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APPENDIX D 
WATCHDOG TIMER CIRCUIT 


EPLD Source Code and Applications Contact Person 


Thom Bowns_PLFG Applications 
Intel 

January 5, 1989 

Rev. 008 

5AC312 

Watchdog timer to cut Vpp from FLASH if erase cycle too long. 
OPTIONS: TURBO = ON 

PART: 5AC312 


INPUTS: CLK, DO@5, D1@4, D2@5, D3@6, D4@7, D5@8, D6é@9, D7@l10, 
nCE@2, nWE@11, TIMER_IN@13, RESET@14, AHR@15 


OUTPUTS: TIMCLR@23, TIMST@22, LED@21, VPP@20 


NETWORK : 
CLK = INP (CLK) 


DO = INP (DO) 
Dl = INP (D1) 
D2 = INP (D2) 
DS = INP (D3) 
D4 = INP (D4) | 
D5 = INP (D5) 
Dé = INP (D6) 
D7 = INP (D7) 


nCE = INP (nCE) 

nWE = INP (nWE) 

TIMER_IN = INP (TIMER_IN) 
RESET = INP (RESET) 


AHR = INP (AHR) % RESET active high if AHR is high % 
COND1 = NOCF (Cld) % Conditions 1-4 are routed % 
COND2 = NOCF (C2qd) %® through combinatorial feedbacks % 
CONDS = NOCF (C3d) % to reduce product term count. % 
COND4 = NOCF (C4d) % % 
CLR = NOCF (CLRd) 


EQUATIONS: 


CLRd = RESET * AHR + !RESET * !AHR; 
TIMEOUT = /TIMER_IN; 


Clad = (/nCE * /nWE * 208) ; % Write 20 % 

C2d = (/nCE * /nWE * a0B) ; % Write AO % 

C3d = (/nCE * /nWE * /208H) ; % Write other than 20 % 
C4d = (/nCE * /nWE * /AORH) ; % Write other than AO % 
208 = J07..* J06.%:..J05 * sé * fos * sD02.* JDL. * fsD0; 
AOH = /D7 * s/D6 * fDS * /D4 * fDS * JDZ * JDL * :f/D03 
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MATCHING: WATCHDOG 
CLOCK: CLK 
STATES : VPP LED TIMST TIMCLR XSB 
0 0 


[ E 
[ 0 
[ 0 
[ 0 
[ 0 
[ 0 
[ 0 
[ 0 
[ 1 


OrPrPrPRFRFFO 


% TRANSITION STATEMENTS % 


START: Sl 

Sl: THEN 
THEN 
THEN 
THEN 
THEN 
THEN 


From power up, go to Sl right away 
If write 20, go to next state 
Until not write 20, hold 


If another write 20, start timer 
If write other than 20, error 


Trigger timer then go to S5 loop 
If write AO, stop timer 

If timer times out, 

go to error state 

If write other than AO, error 
Stop timer and go back to Sl 
Error state. wait for a RESET. 


THEN 
THEN 


THEN 


THEN 
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EPLD Pinout 
5AC312 


13 LJ TIMER_IN 
292059-14 
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APPENDIX E 


Checklist: Most Common Mistakes that May Lead to Excessive Erasure 


® not programming all bytes to 00 data prior to erasure; 


® not observing the 6 us set-up times between programming or erasure and verification; 
© attempting to program before Vpp is at 12V (Capacitive Load) 


® not latching the erase verify address with the erase verify command, or changing the address on the subsequent 
read cycle; 


Chapters three and four discuss the correct methods of developing and debugging code to diminish the possibility of 
making these mistakes. 
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INTRODUCTION 


Intel’s ETOX (EPROM tunnel oxide) Flash Memory 
adds electrical chip erasure and reprogramming to 
EPROM non-volatility and ease of use. Advances in 
tunnel oxides and photolithography have made it possi- 
ble to develop a double-polysilicon single-transistor 
read/write random access nonvolatile memory, capable 
of greater than 100,000 reprogramming cycles. Intel 
Flash Memory electrically erases all bits in the array 
matrix via electron tunneling. The EPROM program- 
ming mechanism of hot electron injection is employed 
for electrical byte programming. 


A command port interface, internal margin voltage 
generation, power up/down protection and address and 
data latches augment standard EPROM circuitry to 
optimize Intel’s Flash Memory for microprocessor-con- 
trolled reprogramming. 


Read timing parameters on Intel’s 28F256A, 28F512, 
28F010 and 28F020 are equivalent to those of CMOS 
EPROMs, EEPROMs, and SRAMs. Access times as 
fast as 65 ns result from a memory cell current of ap- 
proximately 50 A, low resistance poly-silicide word- 
lines, advanced scaled periphery transistors, and an op- 
timized data-out buffer. 


TECHNOLOGY OVERVIEW 


Intel’s ETOX flash memory technology is derived from 
its standard CMOS EPROM process base. Using ad- 
vanced 1.0 wm and 0.8 wm double-polysilicon n-well 
CMOS technology, Intel Flash Memory employs a 
3.8 wm x 4.0 wm single transistor cell (1.0 wm) technol- 
ogy and a 2.5 wm x 2.9 pm single transistor cell 
(0.8 wm technology), affording equivalent array density 
as comparable EPROM technology. The flash memory 
cell structure is identical to the EPROM structure, ex- 
cept for the thinner gate (tunnel) oxide. Figure 1 com- 
pares the flash memory cell to the EPROM cell. 


High quality tunnel oxide under the single floating 
polysilicon gate promotes electrical erasure. All cells in 
the array are simultaneously erased via Fowler- 
Nordheim tunneling. Applying 12V on the source junc- 
tions and grounding the select gates erases the entire 
array in one second (typical). Programming is accom- 
plished with the standard EPROM mechanism of hot 
electron injection from the cell drain junction to the 
floating gate. Programming is initiated by bringing both 
the select gate and the cell drain to high voltage. Pro- 
gramming occurs at a rate of 10 us pulses per byte. 
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Command Port 


One feature which differentiates Intel’s Flash Memory 
is the command port architecture, illustrated in Figure 
z 


The command port simplifies microprocessor control of 
the erase, erase verify, program, program verify, and 
read operations, without the need for additional control 
pins or the multiplexing of high voltage with control 
functions. On-chip address and data latches minimize 
system interface logic and free the system bus during 
erase and program operations. High voltage (12V) on 
the Vpp pin enables the command port. In the absence 
of this high voltage, the command port defaults to the 
read operation, inhibiting erasure or programming of 
the device. 


EPROM Cell 


SECOND LEVEL *Vc 


POLYSILICON N\A, : : 


Vs 


*Vp 
° GATE OXIDE 
325A 
N+ N+ 


P=SUBSTRATE 294008 -1 


FIRST LEVEL 
POLYSILICON 
(FLOATING) 


Flash Memory Cell 


SECOND LEVEL 


POLYSILICON N\A, 


Vs 


FIRST LEVEL 
POLYSILICON 
(FLOATING) 


° ° 
100A TO 120A 


P=SUBSTRATE 294008-2 


Figure 1. EPROM Cell vs. Flash Memory Cell 


The command port consists of a command register, 
command decoder and state latch, the data-in latch, 
and the address latch. The command decoder output 
directs the operation of the high voltage flash-erase 
switch, program voltage generator, and the erase/pro- 
gram verify voltage generator. 


Functions are selected via the command port in a mi- 
croprocessor write cycle controlled by the Chip-Enable 
and Write-Enable pins. Contents of the address latch 
are updated on the falling edge of Write-Enable. The 
rising edge of Write-Enable latches the command and 
data registers, and initiates operations. 
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Erasure 


Erasure is achieved through a two-step write sequence. 
The erase set-up code is written to the command regis- 
ter in the first cycle. The erase confirmation code is 
written in the second cycle. The rising edge of this sec- 
ond Write-Enable pulse initiates the erase operation. 
The command decoder triggers the high voltage flash- 
erase switch, connecting the 12V supply to the source 
of all bits in the array, while all wordlines are ground- 
ed. Fowler-Nordheim tunneling results in the simulta- 
neous erasure of all bits. 


The array source switch, shown in Figure 3, switches 
high voltage onto the source junctions. During erasure, 
the high voltage latch formed by Ms through Mg en- 
ables transistor M5. Transistor Mj5 pulls the array 
source up to 12V. Transistor Mj¢ pulls the source to 
ground during read and program operations. 


To obtain fast erase times, the device must supply the 


grounded gate breakdown current which occurs on the. 


sources of the memory array. The upper boundary for 
current sourcing capability of Mj5 is set by the maxi- 
mum allowable substrate current. If Vpp is raised to 
12V before Vcc is above approximately 1.8V, the low 
Vcc detect circuit formed by transistors M; to M4 
drives the node LOW Vcc to 9V. Transistors Mg to 
_ My then force the erase circuit into a non-erase state 
with M15 off and Mj¢ on. When Vcc rises above 1.8V, 
the chip will be reset into the read state. 


Writing the erase verify code into the command register 
terminates erasure, latches the address of the byte to 
verify, and sets the internally-generated erase margin 
voltage. The microprocessor then accesses the output 
from the addressed byte using standard read timings. 
The verify procedure repeats for all addresses. Should a 
byte require more time to reach the erased state, anoth- 
er erase operation is applied. The erase and verify oper- 
ations continue until the entire array is erased. 


Programming 


Programming follows a similar flow. The program set- 
up command is written to the command register on the 
first cycle. The second cycle loads the address and data 
latches. The rising edge of the second Write-Enable 
pulse initiates programming by applying high voltage to 
the gates and drains of the bits to be programmed. 
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Writing the program verify command to the register 
terminates the programming operation and applies the 
program verify voltage to the newly programmed byte. 
Again, the addressed byte can be read using standard 
microprocessor read timings. Should the addressed byte 
require more time to reach the programmed state, the 
programming operation and verification are repeated 
until the byte is programmed. 


DEVICE RELIABILITY 


Cell Margining 


Erase and program verification ensure the data reten- 


_ tion of the newly altered memory bits. The cell margin- 


ing performed in the Quick-Pulse Programming and 
Quick-Erase algorithms is more reliable than historical 
overpulsing schemes as margining tests the amount of 
charge stored on the floating gate. 


Intel’s 28F256A through 28F020 Flash Memories em- 
ploy a unique circuit to internally generate the erase 
and program verify voltages. Figure 4 shows a simpli- 
fied version of the circuit. The circuit consists of a high 
voltage switch and the verify voltage generator. Tran- 
sistors M, through Mg, constitute the high voltage 
switch which disconnects Vpp from the resistor when 
the device is not in the verify mode. The verify voltage 
generator includes a resistor divider and a buffer. Inter- 
nal margin voltage generation maintains microproces- 
sor compatibility by eliminating the need for external 
reference voltages. 


Erase/Program Cycling 


One of the most significant aspects of Intel Flash Mem- 
ory is its capability for greater than 100,000 erase/pro- 
gram cycles. Destructive oxide breakdown has been a 
limiting factor in extended cycling of thin oxide 
EEPROMs. Intel’s ETOX flash memory technology 
extends cycling performance through: improved tunnel 
oxide processing that increases charge carrying capabil- 
ity ten-fold; reduced oxide area under stress minimizing 
probability of oxide defects in the region; and reduced 
oxide stress due to a lower peak electric field (lower 
erase voltage than EEPROM). 
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A typical cell erase/program margin (Vt) is shown as a 
function of reprogramming cycles in Figure 5. After 
100,000 reprogramming cycles, a 2.5V program read 
margin exists, ensuring reliable data retention. 


Reliable erase/program cycling also requires proper se- 
lection of the erase Vt maximum and maintenance of a 
tight Vt distribution. The maximum erased Vt is set to 
3.2V via the erase algorithm and the internal erase veri- 
fy circuits. Superior oxide quality gives an erased Vt 
distribution width that improves slightly with cycling 
(Figure 6). The tight erase Vt distribution gives an or- 
der of magnitude of erase time margin to the fastest 
erasing cell (Figure 7). 


FIXED OR GATED 


12V DETECTOR 


COMMAND 
REGISTER 
COMMAND DECODER 
& 
STATE LATCH 
DATA 


ADDRESS 
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Figure 2. Command Port Block Diagram 
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SUMMARY 


Intel’s ETOX flash memory technology is a break- 
through in adding electrical chip-erasure to high-densi- 
ty EPROM technology. Intel’s CMOS Flash Memory 
offers the most cost-effective and reliable alternative for 
read/write random access non-volatile memory. Micro- 
processor-compatible specifications, straightforward in- 
terfacing, and in circuit alterability allow designers to 
easily augment memory flexibility and satisfy the need 
for nonvolatile storage in today’s designs. 
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Figure 3. Array Source Switch 
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High Voltage Switch 
294008-6 


Figure 4. Erase/Program Verify Generator 
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PROGRAM V; MAX 
PROGRAM V; MIN 


PROGRAM READ MARGIN 


-~ 
2 
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(2) 
> 
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Voc MIN 


ERASE READ MARGIN ERASE V, MAX 


ERASE V; MIN 


100 1000 10000 100000 


NUMBER OF CYCLES 
294008-7 


Figure 5. 1M Array V; vs Cycles 


ERASE V, @ 1 CYCLE 


CUMULATIVE CELLS ERASED (%) 


ERASE V, @ 10000 CYCLES 


1.75 2.0 2.25 2.50 2.75 3.0 


ERASE V, (VOLTS) 
294008-8 


Figure 6. Erase V; Distribution vs Cycling 
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ARRAY ERASE 


ERASE CELL V, VERIFY LEVEL 


SLOW ERASE BIT 
TYPICAL ERASE BITS 


FAST ERASE BIT 
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ERASE TIME (mS) 


Figure 7. Array Erase V; vs Erase Time 
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Figure 8. 28F256A Die Photograph 
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Figure 9. 28F512 Die Photograph 
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Figure 10. 28F010 (1.0) Die Photograph 
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Figure 11. 28F020 Die (1.0) Photograph 
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Byte-Wide Flash Memory in 32-Pin DIP 


1M (128Kx 8) 
512K (64Kx8) 


256K (32Kx8) 


32 PIN DIP 
0.800" WIDE 
TOP VIEW 


294008-17 


Figure 12. Flash Memory Pinouts 
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Byte-Wide Flash Memory in 32-Pin PLCC 
2M (256K X 8) | 
1M (128K X 8) 
512K (64K X 8) 


256K (32K X 8) 


32-LEAD PLCC 
0.450" x 0.550" 


TOP VIEW 
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Figure 13. Flash Memory Pinouts 
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Byte-Wide Flash Memory in 32-Lead TSOP 


E28F0O20 
E28F010 


STANDARD PINOUT 
Die Up "E" 
32 LEAD TSOP 
8 mm x 20 mm 
TOP VIEW 


F28FO020 
F28F010 


REVERSE PINOUT 
Die Down "F" 
32 LEAD TSOP 
8 mm x 20 mm 

TOP VIEW 


Figure 14. Flash Memory Pinouts 
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Columns are number 0 through 511 beginning with the column nearest the X-decoder. 

Outputs are grouped as follows: 


Left Half Array Right Half Array 
Array Organization: 109 103 102 103 104 105 10g 107 
BL3s4 <— Blo BLo — Bl3e4 


Address 
| Ara | Ar2 | Ato | Az | Ar | Ao | As | 109&107 | 10;&105 | 102&105 | 103 & 104 | 


0 


nn Mokookolokonono 
—~-3-3=3e0C0000000 
—~-3---=-e0C0000000 
—-=--==3 e0CO000000 
-=-0002-=00-=00 


ee a a i > i a) 
-O-'0O06e-0-0+-_ 0-0 


Figure 15. 28F256A Bitline Decoding 


X Address 
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Figure 16. 28F256A Wordline Decoding 
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Figure 17. 28F256A Bit Map 


5-200 


intel i | ER-24 


Columns are numbered 0 through 511 beginning with the column nearest the X-decoder. 


Outputs are grouped as follows: 


Left Half Array Right Half Array 
OO O1 02 _ O04 O5 O6 O7 


Address 
a ae Ta [aso Tae [at [a0 [oor [zee [tras [ara 


ttt eQoooonos 
tit. —+ a - Soooodcona 
ACGnQo~@+soao4840=40 
tvtttww - Gogceonodos 
ti: @OO@G@on0noo 6 

aha eh ed Gok alt iS ee 

tA OOo esi 4398 oH8 Hod 


Figure 18. 28F512 Bitline Decoding 


X-DECODING: Wordlines are numbered 0 through 511 beginning at the top of the array. 
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Figure 19. 28F512 Wordline Decoding 
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X-DECODING: Wordlines are number 0 through 511 beginning at the top of the array. 
X Address 
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Figure 19. 28F512 Wordline Decoding (Continued) 
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Figure 20. 28F512 Bit Map 
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Columns are number 0 through 511 beginning with the column nearest the X-decoder. 
Outputs are grouped as follows: 


Left Half Array Right Half Array 
, Array Organization: 109 10; 102 103 104 105 10g 107 
BL3g4 <— Blo Blo — Bl3e4 


Address 
Are | Ais | Aro | Az | Ar | Ao | As | 109&107 | 101&105 | 102&105 | 1038104 _ 
0 0 0 0 


tiivan—-@eqooodncooo0oso 
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COOOH m4 4 OOOO SB sae aelas sin QoOoos==40000 
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Figure 22. 28F010 Wordline Decoding 
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Figure 23. 28F010 Bit Map 
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Columns are number 0 through 511 beginning with the column nearest the X-decoder. 

Outputs are grouped as follows: 


Left Half Array Right Half Array 
Array Organization: 1O9 103 102 103 104 105 10g 107 
BL3g4 <— Blo BLo — BL3eq4 


Address 
Are | Ars | Aro | Az | Ar | Ao | As | 10p&I07 | 10,&105 | 1028105 | 103& 104 
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Figure 25. 28F020 Wordline Decoding 
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Figure 26. 28F020 Bit Map 
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Intel Flash Memory Evaluation Kit II 
(D, FLASHEVAL2) Product Brief 


Kit @ (1) PC AT*#/PC XT* Add-In 
Contents Driver Board with DIP ZIF 
Connector 


@ (1) User’s Manual 


@ Sample Flash Memory Devices, 
Including: 
w (1) 28F256A 
m@ (1) 28F010 
@ (1) 28FO0IBX-B 
mw (1) 28F512 
mw (1) 28F020 
w@ (1) 28FO0IBX-T 
@ (1) 5.25” Floppy Disk with 
iFLASH2 Software 


@ Technical Documentation 
Describing Intel’s Flash 


Memory Products Intel's Flash Memory Evaluation Kit Il provides the system designer with a 


cost-effective prototyping tool for programming and erasing Intel Flash 
Memory products. Its software upgrade capability enables Intel to provide 
programming support for new flash memories coincident with their 
introduction. The Flash Memory Evaluation Kit's modular design provides 
compatibility with future Intel flash memory packages and form factors 
through hardware adapter upgrade modules. This kit is a significant 
enhancement to the Intel Flash Memory Evaluation Kit I, adding support for 
new devices and providing new software with easy user interface, additional 
capabilities and on-line help. 


@ Registration Card 


Kit Description 


The Intel Flash Memory Evaluation Kit II is a PC-driven flash memory 
programming solution. With this kit, a system designer can program and erase 
Intel’s flash memory components directly, and flash memory cards, SIMMs and 
advance packaged components using separately available hardware adapters. 


The kit’s Users Guide provides software and hardware installation instructions and 
an overview of software features. 


*PC-XT and PC-AT are trademarks of International Business Machines, Inc. 
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SMALL OUTLINE PACKAGE 
PHYSICAL DIMENSIONS 


1.0 Case Outlines for Intel’s 32-, 40-, 56-Lead TSOP and 44-Lead PSOP Packages 


32-Lead Thin Small Outline Package (TSOP) 


SEE DETAIL A 


sy 


DETAIL A 


297186-1 


[___Willimeters. =< —~S~*~<~*~sies 
a on ie ee ee eee 
LO EEE CC 
pewen 2 a oe i Pe 
[Package Body Thickness A2 | 096 | 101 | 1.06 | o.0a7e | 00398 | 00417 
Ttead Width ——SSSCBSS*dY (tO | 0.200 | 0.260 
0.0039 
0.7244 
0.3130 

Pitch 


Terminal Dimension E 0.7835 0.7874 0.7913 


. | Free. 
a ee Be 


0.0314 0.0374 


pe BET: OM 
0.0079 0.0098 


Figure 1-1. 32-Lead TSOP Package Drawing and Specifications 


August 1993 
Order Number: 297186-001 5-209 
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40-Lead Thin Small Outline Package (TSOP) 


SEE DETAIL B 


SEE DETAIL A 
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DETAIL A DETAIL B 


natal frame & 


297186-2 


| Millimeters | sInches, 

ee eee ee ae 

ee ee ed Ree MD MR i a 
Rese 


2 ae cee eo ee ee 
| Package Body Thickness __A2_| 0.965 | 0.995 | 1.025 | 0379 | 0.0991 | 0.0403 _ 
_teadwidh Ss Bf 0150 | 020 | 0.260 | 0.0059 | 0.0078 | 0.0096 _ 
| LeadThickness | 0.120 | o.te7 | 0.194 | 0.0046 | 0.0049 | 0.0052 _ 
| 10.00 | 1020 | 09858 | 0.9997 | 0.4015 | 
peers Jee | | 0.50_| ae a eo ae 
Terminal Dimension | BOOS 
Lead Tip Angle é Pee CR aie ESE ie Bano 
| 0.390 _| 
Meee Be Siena, 
NOTES: 


| 0.950 | 0.0236 | 0.0314 | 0.0974 

BREDA 05 Dies eed 

| 0.25 | 0.30 | 0.0079 | 0.0098 | 0.0118 | 

Figure 1-2. 40-Lead TSOP Physical Dimensions and Specifications 
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56-Lead Thin Small Outline Package (TSOP) 
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SEE DETAIL B 
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. © eae SEE DETAIL A 
ro 


DETAIL A DETAIL B 
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Sec arom ir “ee hee 
[i PackageHeight A io | re 5 


ee eee ae Te eee ae ee es 


Package Body Length D 
S."  ery e Saree 
| leadTipange | 
| Lead TipLength Lk | 0.900 
| beadCount UN | 
NOTES: 
| o0314 | 0.0374 | 
| Seating Plane Coplanarity | | | | 0.0039 
| _LeadtoPackage Offset | 0.20 | 0.25 | 0.90 | 0.0079 | 0.0098 | 0.0118 _| 


Figure 1-3. 56-Lead TSOP Package Drawings and Specifications 
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44-Lead Plastic Small Outline Package (PSOP) 


SEE ae 
297186-4 


| Millimeters | since 

CE sec care ies aa a 
Dd a a a aR OE TS De 
| Standoff ATT | 0.225 | 0.95 | 0.005 | 0.009 | 0.013 
| PackageBody Thickness —A2_—| 2.17 | 2.30 | 245 | 0.085 | 0.091 | 0.097 

Lead Width | 0.35 | 0.014 | 0.016 | 

Lead Thickness Peete: 

Package Body Length eee 
Package Body Width 13.30 13.50 | 


| Package Body Width EE 
fe ee re | 0.050 _| 
| Terminal Dimension He _| 


0.516 


Terminal Dimension He 15.70 16.30 0.618 0.630 0.642 


Lead Tip Angle 
Lead Tip Length 
Lead Count 


Figure 1-4. 44-Lead PSOP Physical Dimensions and Specifications 
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2.0 SOP Board Footprints 
A typical land pad diagram for the 32-Lead TSOP package is shown in Figure 2-1. 
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Figure 2-1. Typical TSOP Land Pad Diagram 


Similar land pad diagrams can be constructed for the 40-lead and 56-lead TSOP packages. The 40-lead land pad 
diagram can be constructed by adding four leads to both sides of the 32-lead land pad diagram, while maintaining 
the spacing between the lead footprints. The total footprint width becomes 9.80mm instead of 7.80mm used with the 
32-lead package. With the 56-lead package, 12 leads are added to both sides of the 32-lead land pad diagram, while 
maintaining the spacing between the lead footprints. The total footprint width becomes 13.80mm instead of the 
7.80mm used with the 32-lead package. 
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A typical land pad diagram for the 44-Lead PSOP is shown in Figure 2-2. 
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Figure 2-2. Typical PSOP Land Pad Diagram 


3.0 SOP Component Volume and Weight 


Table 3-1 shows the component volume and weight of the SOP package family. 


Table 3-1. SOP Component Weight and Volume 


[Package | Maxioight | Max Volume | Average Weight 
seLeadtsor | 120mm | seam’ | 0659s 
Tatteadtsor | 26emm | 1226.7mmo | 1e6gms 
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ALABAMA 


Intel Corp. 

600 Boulevard South 
Suite 104-1 
Huntsville 35802 

Tel: (800) 628-8686 
FAX: (205) 883-3511 


ARIZONA 


tintel Corp. 

410 North 44th Street 
Suite 500 

Phoenix 85008 

Tel: (800) 628-8686 
FAX: (602) 244-0446 


CALIFORNIA 


Intel Corp. 

3550 Watt Avenue 
Suite 140 
Sacramento 95821 
Tel: (800) 628-8686 
FAX: (916) 488-1473 


tintel Corp. 

9655 Granite Ridge Dr. 
3rd Floor, Suite 4A 
San Diego 92123 

Tel: (800) 628-8686 
FAX: (619) 467-2460 


Intel Corp. 

1781 Fox Drive 

San Jose 95131 

Tel: (800) 628-8686 
FAX: (408) 441-9540 


*tIntel Corp. 

1551 N. Tustin Avenue 
Suite 800 

Santa Ana 92701 

Tel: (800) 628-8686 
TWX: 910-595-1114 
FAX: (714) 541-9157 


tintel Corp. 

15260 Ventura Boulevard 
Suite 360 

Sherman Oaks 91403 
Tel: (800) 628-8686 

FAX: (818) 995-6624 


COLORADO 


*tintel Corp. 

600 S. Cherry St. 
Suite 700 

Denver 80222 

Tel: (800) 628-8686 
TWX: 910-931-2289 
FAX: (303) 322-8670 


CONNECTICUT 


tintel Corp. 

103 Mill Plain Road 
Danbury 06811 

Tel: (800) 628-8686 
FAX: (203) 794-0339 


FLORIDA 


tintel Corp. 

800 Fairway Drive 
Suite 160 

Deerfield Beach 33441 
‘Tel: (800) 628-8686 
FAX: (305) 421-2444 


Intel Corp. 

2250 Lucien Way 
Suite 100, Room 8 
Maitland 32751 

Tel: (800) 628-8686 
FAX: (407) 660-1283 


tSales and Service Office 
*Field Application Location 


NORTH AMERICAN SALES OFFICES 


GEORGIA 


tintel Corp. 

20 Technology Parkway 
Suite 150 

Norcross 30092 

Tel: (800) 628-8686 
FAX: (404) 605-9762 


IDAHO 


Intel Corp. 

9456 Fairview Ave., Suite C 
Boise 83704 

Tel: (800) 628-8686 

FAX: (208) 377-1052 


ILLINOIS 


*tintel Corp. 

Woodfield Corp. Center Ill 
300 N. Martingale Road 
Suite 400 

Schaumburg 60173 

Tel: (800) 628-8686 

FAX: (708) 706-9762 


INDIANA 


tintel Corp. 

8910 Purdue Road 
Suite 350 
Indianapolis 46268 
Tel: (800) 628-8686 
FAX: (317) 875-8938 


MARYLAND 


*tintel Corp. 

10010 Junction Dr. 

Suite 200 

Annapolis Junction 20701 
Tel: (800) 628-8686 

FAX: (410) 206-3678 


MASSACHUSETTS 


*tintel Corp. 

Westford Corp. Center 
5 Carlisle Road 

2nd Floor 

Westford 01886 

Tel: (800) 628-8686 
TWX: 710-343-6333 
FAX: (508) 692-7867 


MICHIGAN 


tintel Corp. 

7071 Orchard Lake Road 
Suite 100 

West Bloomfield 48322 
Tel: (800) 628-8686 

FAX: (313) 851-8770 


MINNESOTA 


tintel Corp. 

3500 W. 80th St. 
Suite 360 
Bloomington 55431 
Tel: (800) 628-8686 
TWX: 910-576-2867 
FAX: (612) 831-6497 


NEW JERSEY 


Intel Corp. 

2001 Route 46, Suite 310 
Parsippany 07054-1315 
Tel: (800) 628-8686 

FAX: (201) 402-4893 


*tintel Corp. 

Lincroft Office Center 
125 Half Mile Road 
Red Bank 07701 

Tel: (800) 628-8686 
FAX: (908) 747-0983 


NEW YORK 


*Intel Corp. 

850 Crosskeys Office Park 
Fairport 14450 

Tel: (800) 628-8686 

TWX: 510-253-7391 

FAX: (716) 223-2561 


tintel Corp. 

300 Westage Business Center 
Suite 230 

Fishkill 12524 

Tel: (800) 628-8686 

FAX: (914) 897-3125 


*tintel Corp. 

2950 Express Dr., South 
Suite 130 

Islandia 11722 

Tel: (800) 628-8686 
TWX: 510-227-6236 
FAX: (516) 348-7939 


OHIO 


*Intel Corp. 

56 Milford Dr., Suite 205 
Hudson 44236 

Tel: (800) 628-8686 
FAX: (216) 528-1026 


*tintel Corp. 

3401 Park Center Drive 
Suite 220 

Dayton 45414 

Tel: (800) 628-8686 
TWX: 810-450-2528 
FAX: (513) 890-8658 


OKLAHOMA 


Intel Corp. 

6801 N. Broadway 
Suite 115 

Oklahoma City 73162 
Tel: (800) 628-8686 
FAX: (405) 840-9819 


OREGON 


tintel Corp. 

15254 N.W. Greenbrier Pkwy. 
Building B 

Beaverton 97006 

Tel: (800) 628-8686 

TWX: 910-467-8741 

FAX: (503) 645-8181 


PENNSYLVANIA 


*tintel Corp. 

925 Harvest Drive 
Suite 200 

Blue Bell 19422 

Tel: (800) 628-8686 
FAX: (215) 641-0785 


SOUTH CAROLINA 


Intel Corp. 

7403 Parklane Rd., Suite 3 
Columbia 29223 

Tel: (800) 628-8686 

FAX: (803) 788-7999 


Intel Corp. 

100 Executive Center Drive 
Suite 109, B183 

Greenville 29615 

Tel: (800) 628-8686 

FAX: (803) 297-3401 


TEXAS 


tintel Corp. 

8911 N. Capital of Texas Hwy. 
Suite 4230 

Austin 78759 

Tel: (800) 628-8686 

FAX: (512) 338-9335 


*tintel Corp. 

5000 Quorum Drive 
Suite 750 

Dallas 75240 

Tel: (800) 628-8686 


*tintel Corp. 

20515 SH 249 

Suite 401 

Houston 77070 

Tel: (800) 628-8686 
TWX: 910-881-2490 
FAX: (713) 988-3660 


UTAH 


tintel Corp. 

428 East 6400 South 
Suite 135 

Murray 84107 

Tel: (800) 628-8686 
FAX: (801) 268-1457 


WASHINGTON 


tintel Corp. 

2800 156th Avenue S.E. 
Suite 105 

Bellevue 98007 

Tel: (800) 628-8686 
FAX: (206) 746-4495 


WISCONSIN 


Intel Corp. 

400 N. Executive Dr. 
Suite 401 

Brookfield 53005 
Tel: (800) 628-8686 
FAX: (414) 789-2746 


CANADA 


BRITISH COLUMBIA 


Intel Semiconductor of 
Canada, Ltd. 

999 Canada Place - 
Suite 404, #11 
Vancouver V6C 3E2 
Tel: (800) 628-8686 
FAX: (604) 844-2813 


ONTARIO 


tintel Semiconductor of 
Canada, Ltd. 

2650 Queensview Drive 
Suite 250 

Ottawa K2B 8H6 

Tel: (800) 628-8686 
FAX: (613) 820-5936 


tintel Semiconductor of 
Canada, Ltd. 

190 Attwell Drive 

Suite 500 

Rexdale M9W 6H8 

Tel: (800) 628-8686 
FAX: (416) 675-2438 


QUEBEC 


tintel Semiconductor of 
Canada, Ltd. 

1 Rue Holiday 

Suite 320 

Tour East 

Pt. Claire H9R 5N3 

Tel: (800) 628-8686 
FAX: 514-694-0064 
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ABAMA 


row/Schweber Electronics 
15 Henderson Road 
intsville 35806 

|: (205) 837-6955 

X: (205) 721-1581 


milton Hallmark 

90 University Square, #1 
intsville 35816 

I: (205) 837-8700 

X: (205) 830-2565 


[| Systems 

50 Corporate Dr., #120 
intsville 35805 

I: (205) 830-9526 

X: (205) 830-9557 


yneer Technologies Group 
35 University Square, #5 
intsville 35805 

|: (205) 837-9300 

X: (205) 837-9358 


‘le Laboratories 

00 Governers Drive 
wer Building, 2nd Floor 
intsville 35806 

|: (205) 830-1119 

X: (205) 830-1520 


NZONA 


them Electronics 

55 W. 10th Place, #101 
mpe 85281 

i: (602) 966-6600 

X: (602) 966-4826 


‘ow/Schweber Electronics 
15 W. Erie Drive 

mpe 85282 

|: (602) 431-0030 

X: (602) 252-9109 


net Computer 

26 S. Edwards Drive 
mpe 85281 

|: (602) 902-4600 

X: (602) 902-4640 


milton Hallmark 
37 S. 36th Place 
oenix 85040 

|: (602) 437-1200 
X: (602) 437-2348 


Ne Laboratories 
41 £. Raymond 
oenix 85040 

|: (602) 437-2088 
X: (602) 437-2124 


\LIFORNIA 


them Electronics 
31 Oakdale Ave. 
atsworth 91311 

|: (818) 775-1333 
X: (818) 775-1302 


them Electronics 
idfield Drive 

ne 92718-2809 

: (714) 768-4444 
X: (714) 768-6456 


them Electronics 
0 Menlo Drive, #8 
cklin 95677 

|: (916) 624-9744 
X: (916) 624-9750 


them Electronics 

59 Carroll Park Drive 
n Diego 92121 

|: (619) 453-9005 

X: (619) 546-7893 


them Electronics 

50 Ridder Park Drive 
n Jose 95131 

|: (408) 452-2219 

X: (408) 441-4504 


ow Commercial Systems Group 
02 Crocker Avenue 


yward 94544 

: (510) 489-5371 

X: (510) 489-9393 

ow Commercial Systems Group 
242 Chambers Road 

stin 92680 

: (714) 544-0200 

X: (714) 731-8438 
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Arrow/Schweber Electronics 
26707 W. Agoura Road 
Calabasas 91302 

Tel: (818) 880-9686 

FAX: (818) 772-8930 


Arrow/Schweber Electronics 
48834 Kato Road, Suite 103 
Fremont 94538 

Tel: (510) 490-9477 


Arrow/Schweber Electronics 
6 Cromwell #100 

Irvine 92718 

Tel: (714) 838-5422 

FAX: (714) 454-4206 


Arrow/Schweber Electronics 
9511 Ridgehaven Court 
San Diego 92123 

Tel: (619) 565-4800 

FAX: (619) 279-8062 


Arrow/Schweber Electronics 
1180 Murphy Avenue 

San Jose 95131 

Tel: (408) 441-9700 

FAX: (408) 453-4810 


Avnet Computer 
3170 Pullman Street 
Costa Mesa 92626 
Tel: (714) 641-4150 
FAX: (714) 641-4170 


Avnet Computer 

1361B West 190th Street 
Gardena 90248 ; 
Tel: (800) 426-7999 
FAX: (310) 327-5389 


Avnet Computer 


755 Sunrise Boulevard, #150 


Roseville 95661 
Tel: (916) 781-2521 
FAX: (916) 781-3819 


Avnet Computer 

1175 Bordeaux Drive, #A 
Sunnyvale 94089 

Tel: (408) 743-3454 

FAX: (408) 743-3348 


Avnet Computer 
21150 Califa Street 
Woodland Hills 91376 
Tel: (818) 594-8301 
FAX: (818) 594-8333 


Hamilton Halimark 
3170 Pullman Street 
Costa Mesa 92626 
Tel: (714) 641-4100 
FAX: (714) 641-4122 


Hamilton Hallmark 

1175 Bordeaux Drive, #A 
Sunnyvale 94089 

Tel: (408) 435-3500 

FAX: (408) 745-6679 


Hamilton Hallmark 
4545 Viewridge Avenue 
San Diego 92123 

Tel: (619) 571-7540 
FAX: (619) 277-6136 


Hamilton Hallmark 
21150 Califa St. 
Woodland Hills 91367 
Tel: (818) 594-0404 
FAX: (818) 594-8234 


Hamilton Hallmark 
580 Menlo Drive, #2 
Rocklin 95762 

Tel: (916) 624-9781 
FAX: (916) 961-0922 


Pioneer Standard 

5850 Canoga Bivd., #400 
Woodland Hills 91367 
Tel: (818) 883-4640 


Pioneer Standard 

217 Technology Dr., #110 
Irvine 92718 

Tel: (714) 753-5090 


Pioneer Technologies Group 
134 Rio Robles 

San Jose 95134 

Tel: (408) 954-9100 

FAX: (408) 954-9113 


Wyle Laboratories 
15370 Barranca Pkwy. 
Irvine 92713 

Tel: (714) 753-9953 
FAX: (714) 753-9877 


Wyle Laboratories 


15360 Barranca Pkwy., #200 


Irvine 92713 
Tel: (714) 753-9953 
FAX: (714) 753-9877 


Wyle Laboratories 

2951 Sunrise Bivd., #175 
Rancho Cordova 95742 
Tel: (916) 638-5282 

FAX: (916) 638-1491 


Wyle Laboratories 

9525 Chesapeake Drive 
San Diego 92123 

Tel: (619) 565-9171 
FAX: (619) 365-0512 


Wyle Laboratories 
3000 Bowers Avenue 
Santa Clara 95051 
Tel: (408) 727-2500 
FAX: (408) 727-5896 


Wyle Laboratories 
17872 Cowan Avenue 
Irvine 92714 

Tel: (714) 863-9953 
FAX: (714) 263-0473 


Wyle Laboratories 

26010 Mureau Road, #150 
Calabasas 91302 

Tel: (818) 880-9000 

FAX: (818) 880-5510 


Zeus Arrow Electronics 
6276 San Ignacio Ave., #E 
San Jose 95119 

Tel: (408) 629-4789 

FAX: (408) 629-4792 


Zeus Arrow Electronics 
22700 Savi Ranch Pkwy. 
Yorba Linda 92687-4613 
Tel: (714) 921-9000 
FAX: (714) 921-2715 


COLORADO 


Anthem Electronics 

373 Inverness Drive South 
Englewood 80112 

Tel: (303) 790-4500 

FAX: (303) 790-4532 


Arrow/Schweber Electronics 
61 Inverness Dr. East, #105 
Englewood 80112 

Tel: (303) 799-0258 

FAX: (303) 373-5760 


Hamilton Hallmark 

12503 E. Euclid Drive, #20 
Englewood 80111 . 

Tel: (303) 790-1662 

FAX: (303) 790-4991 


Hamilton Hallmark 

710 Wooten Road, #102 
Colorado Springs 80915 
Tel: (719) 637-0055 
FAX: (719) 637-0088 


Wyle Laboratories 
451 E. 124th Avenue 
Thornton 80241 

Tel: (303) 457-9953 
FAX: (303) 457-4831 


CONNECTICUT 


Anthem Electronics 

61 Mattatuck Heights Road 
Waterburg 06705 

Tel: (203) 575-1575 

FAX: (203) 596-3232 


Arrow/Schweber Electronics 
12 Beaumont Road 
Wallingford 06492 

Tel: (203} 265-7741 

FAX: (203) 265-7988 


Avnet Computer 

55 Federal Road, #103 
Danbury 06810 

Tel: (203) 797-2880 
FAX: (203) 791-9050 


Hamilton Hallmark 

125 Commerce Court, Unit 6 
Cheshire 06410 

Tel: (203) 271-2844 

FAX: (203) 272-1704 


Pioneer Standard 

2 Trap Falls Road © 
Shelton 06484 

Tel: (203) 929-5600 


FLORIDA 


Anthem Electronics 

598 South Northlake Bivd., #1024 
Altamonte Springs 32701 

Tel: (813) 797-2900 

FAX: (813) 796-4880 


Arrow/Schweber Electronics 
400 Fairway Drive, #102 
Deerfield Beach 33441 

Tel: (305) 429-8200 

FAX: (305) 428-3991 


Arrow/Schweber Electronics 
37 Skyline Drive, #3101 
Lake Mary 32746 

Tel: (407) 333-9300 

FAX: (407) 333-9320 


Avnet Computer 

3343 W. Commercial Boulevard 
Bidg. C/D, Suite 107 

Ft. Lauderdale 33309 

Tel: (305) 730-9110 

FAX: (305) 730-0368 


Avnet Computer 

3247 Tech Drive North 
St. Petersburg 33716 
Tel: (813) 573-5524 
FAX: (813) 572-4324 


Hamilton Hallmark 

3350 N.W. 53rd St., #105-107 
Ft. Lauderdale 33309 

Tel: (305) 484-5482 

FAX: (305) 484-2995 


Hamilton Hallmark 
10491 72nd St. North 
Largo 34647 

Tel: (813) 541-7440 
FAX: (813) 544-4394 


Hamilton Hallmark 

7079 University Boulevard 
Winter Park 32792 

Tel: (407) 657-3300 

FAX: (407) 678-4414 


Pioneer Technologies Group 
337 Northlake Bivd., #1000 
Alta Monte Springs 32701 
Tel: (407) 834-9090 

FAX: (407) 834-0865 


Pioneer Technologies Group 
674 S. Military Trail 

Deerfield Beach 33442 

Tel: (305) 428-8877 

FAX: (305) 481-2950 


Pioneer Technologies Group 
8031-2 Phillips ay 
Jacksonville 322 

Tel: (904) 730-0065 


Wyle Laboratories 
1000 112 Circle North 
St. Petersburg 33716 
Tel: (813) 530-3400 
FAX: (813) 579-1518 


GEORGIA 


Arrow Commercial Systems Group 
3400 C. Corporate Way 

Duluth 30136 

Tel: (404) 623-8825 

FAX: (404) 623-8802 


Arrow/Schweber Electronics 
4250 E. Rivergreen Pkwy., #E 
Duluth 30136 

Tel: (404) 497-1300 

FAX: (404) 476-1493 


Avnet Computer 

3425 Corporate Way, #G 
Duluth 30136 

Tel: (404) 623-5452 

FAX: (404) 476-0125 


Hamilton Hallmark 

3425 Corporate Way, #G & #A 
Duluth 30136 

Tel: (404) 623-5475 

FAX: (404) 623-5490 


Pioneer Technologies Group 
4250 C. Rivergreen Parkway 
Duluth 30136 

Tel: (404) 623-1003 

FAX: (404) 623-0665 


Wyle Laboratories 

6025 The Corners Pkwy., #111 
Norcross 30092 

Tel: (404) 441-9045 

FAX: (404) 441-9086 


ILLINOIS 


Anthem Electronics 

1300 Remington Road, Suite A 
Schaumberg 60173 

Tel: (708) 0200 

FAX: (708) 885-0480 


Arrow/Schweber Electronics 
1140 W. Thorndale Rd. 
Itasca 60143 

Tel: (708) 250-0500 


Avnet Computer 

1124 Thorndale Avenue 
Bensenville 60106 

Tel: (708) 860-8572 
FAX: (708) 773-7976 


Hamilton Hallmark 

1130 Thorndale Avenue 
Bensenville 60106 

Tel: (708) 860-7780 


\ FAX: (708) 860-8530 


MTI Systems 

1140 W. Thorndale Avenue 
Itasca 60143 

Tel: (708) 250-8222 

FAX: (708) 250-8275 


Pioneer Standard 

2171 Executive Dr., #200 
Addison 60101 

Tel: (708) 495-9680 

FAX: (708) 495-9831 


Wyle Laboratories 

2055 Army Trail Road, #140 
Addison 60101 

Tel: (800) 853-9953 

FAX: (708) 620-1610 


INDIANA 


Arrow/Schweber Electronics 
7108 Lakeview Parkway West Dr. 
Indianapolis 46268 

Tel: (317) 299-2071 

FAX: (317) 299-2379 


Avnet Computer 
485 Gradle Drive 
Carmel 46032 

Tel: (317) 575-8029 
FAX: (317) 844-4964 


Hamilton Hallmark 
4275 W. 96th 
Indianapolis 46268 
Tel: (317) 872-8875 
FAX: (317) 876-7165 


Pioneer Standard 

9350 Priority Way West Dr. 
Indianapolis 46250 

Tel: (317) 573-0880 

FAX: (317) 573-0979 


CG/SALE/111293 


In 


KANSAS 


Arrow/Schweber Electronics 
9801 Legler Road 

Lenexa 66219 

Tel: (913) 541-9542 

FAX: (913) 541-0328 


Avnet Computer 
15313 W. 95th Street 
Lenexa 61219 

Tel: (913) 541-7989 
FAX: (913) 541-7904 


Hamilton Hallmark 
10809 Lakeview Avenue 
Lenexa 66215 

Tel: (913) 888-4747 
FAX: (913) 888-0523 


KENTUCKY 


Hamilton Hallmark 
1847 Mercer Road, #G 
Lexington 40511 

Tel: (800) 235-6039 
FAX: (606) 288-4936 


MARYLAND 


Anthem Electronics 

7168A Columbia Gateway Drive 
Columbia 21046 

Tel: (410) 995-6640 

FAX: (410) 290-9862 


Arrow Commercial Systems Group 
200 Perry Parkway 

Gaithersburg 20877 

Tel: (301) 670-1600 

FAX: (301) 670-0188 


Arrow/Schweber Electronics 
9800J Patuxent Woods Dr. 
Columbia 21046 

Tel: (301) 596-7800 

FAX: (301) 995-6201 


Avnet Computer 

7172 Columbia Gateway Dr., #G 
Columbia 21045 

Tel: (301) 995-3571 

FAX: (301) 995-3515 


Hamilton Hallmark 

10240 Old Columbia Road 
Columbia 21046 

Tel: (410) 988-9800 

FAX: (410) 381-2036 


North Atlantic Industries 
Systems Division 

7125 River Wood Dr. 

Columbia 21046 

Tel: (301) 312-5800 

FAX: (301) 312-5850 


Pioneer Technologies Group 
15810 Gaither Road 
Gaithersburg 20877 

Tel: (301) 921-0660 

FAX: (301) 670-6746 


Wyle Laboratories 

7180 Columbia Gateway Dr. 
Columbia 21046 

Tel: (410) 312-4844 

FAX: (410) 312-4953 


MASSACHUSETTS 


Anthem Electronics 
36 Jonspin Road 
Wilmington 01887 
Tel: (508) 657-5170 
FAX: (508) 657-6008 


Arrow/Schweber Electronics 
25 Upton Dr. 

Wilmington 01887 

Tel: (508) 658-0900 

FAX: (508) 694-1754 


Avnet Computer 

10 D Centennial Drive 
Peabody 01960 

Tel: (508) 532-9886 
FAX: (508) 532-9660 


Hamilton Hallmark 

10 D Centennial Drive 
Peabody 01960 

Tel: (508) 531-7430 
FAX: (508) 532-9802 


Pioneer Standard 

44 Hartwell Avenue 
Lexington 02173 
Tel: (617) 861-9200 
FAX: (617) 863-1547 


Wyle Laboratories 
15 Third Avenue. 
Burlington 01803 
Tel: (617) 272-7300 
FAX: (617) 272-6809 


MICHIGAN 


Arrow/Schweber Electronics 
19880 Haggerty Road 
Livonia 48152 

Tel: (800) 231-7902 

FAX: (313) 462-2686 


Avnet Computer 

2876 28th Street, S.W., #5 
Grandville 49418 

Tel: (616) 531-9607 

FAX: (616) 531-0059 


Avnet Computer 

41650 Garden Brook Rd. #120 
Novi 48375 

Tel: (313) 347-1820 

FAX: (313) 347-4067 


Hamilton Hallmark 

44191 Plymouth Oaks Blvd., #1300 
Plymouth 48170 

Tel: (313) 416-5800 

FAX: (313) 416-5811 


Hamilton Hallmark 

41650 Garden Brook Rd., #100 
Novi 49418 

Tel: (313) 347-4271 

FAX: (313) 347-4021 


Pioneer Standard 
4505 Broadmoor S.E. 
Grand Rapids 49512 
Tel: (616) 698-1800 
FAX: (616) 698-1831 


Pioneer Standard 
13485 Stamford 
Livonia 48150 

Tel: (313) 525-1800 
FAX: (313) 427-3720 


MINNESOTA 


Anthem Electronics 

7646 Golden Triangle Drive 
Eden Prairie 55344 

Tel: (612) 944-5454 

FAX: (612) 944-3045 


Arrow/Schweber Electronics 
10100 Viking Drive, #100 
Eden Prairie 55344 

Tel: (612) 941-5280 

FAX: (612) 942-7803 


Avnet Computer 

10000 West 76th Street 
Eden Prairie 55344 
Tel: (612) 829-0025 
FAX: (612) 944-2781 


Hamilton Hallmark 

9401 James Ave South, #140 
Bloomington 55431 

Tel: (612) 881-2600 

FAX: (612) 881-9461 


Pioneer Standard 

7625 Golden Triange Dr., #G 
Eden Prairie 55344 

Tel: (612) 944-3355 

FAX: (612) 944-3794 


Wyle Laboratories 
1325 E. 79th Street, #1 
Bloomington 55425 
Tel: (612) 853-2280 
FAX: (612) 853-2298 


MISSOURI 


Arrow/Schweber Electronics 
2380 Schuetz Road 

St. Louis 63141 

Tel: (314) 567-6888 

FAX: (314) 567-1164 


Avnet Computer 

741 Goddard Avenue 
Chesterfield 63005 
Tel: (314) 537-2725 
FAX: (314) 537-4248 


Hamilton Hallmark 
3783 Rider Trail South 
Earth City 63045 

Tel: (314) 291-5350 
FAX: (314) 291-0362 


NEW HAMPSHIRE 


Avnet Computer — . 
2 Executive Park Drive 
Bedford 03102 

Tel: (800) 442-8638 
FAX: (603) 624-2402 


NEW JERSEY 


Anthem Electronics 

26 Chapin Road, Unit K 
Pine Brook 07058 

Tel: (201) 227-7960 
FAX: (201) 227-9246 


Arrow/Schweber Electronics 
4 East Stow Rd., Unit 11 
Marlton 08053 

Tel: (609) 596-8000 

FAX: (609) 596-9632 


Arrow/Schweber Electronics 
43 Route 46 East 

Pine Brook 07058 

Tel: (201) 227-7880 

FAX: (201) 538-4962 


Avnet Computer 

1-B Keystone Ave., Bldg. 36 
Cherry Hill 08003 

Tel: (609) 424-8961 

FAX: (609) 751-2502 


Hamilton Hallmark 

1 Keystone Ave., Bldg. 36 
Cherry Hill 08003 

Tel: (609) 424-0110 

FAX: (609) 751-2552 


Hamilton Hallmark 

10 Lanidex Plaza West 
Parsippani 07054 

Tel: (201) 515-5300 
FAX: (201) 515-1601 


MTI Systems 

43 Route 46 East 
Pinebrook 07058 
Tel: (201) 882-8780 
FAX: (201) 539-6430 


Pioneer Standard 
14-A Madison Rd. 
Fairfield 07006 

Tel: (201) 575-3510 
FAX: (201) 575-3454 


Wyle Laboratories 


20 Chapin Road, Bidg. 10-13 
Pinebrook 07058 

Tel: (201) 882-8358 

FAX: (201) 882-9109 


NEW MEXICO 


Alliance Electronics, Inc. 
10510 Research Ave. 
Albuquerque 87123 

Tel: (505) 292-3360 
FAX: (505) 275-6392 


Avnet Computer 
7801 Academy Rd. 
Bidg. 1, Suite 204 
Albuquerque 87109 
Tel: (505) 828-9725 
FAX: (505) 828-0360 


NEW YORK 


Anthem Electronics 
47 Mall Drive 
Commack 11725 
Tel: (516) 864-6600 
FAX: (516) 493-2244 


Arrow/Schweber Electronics 
3375 Brighton Henrietta 
Townline Rd. 

Rochester 14623 

Tel: (716) 427-0300 

FAX: (716) 427-0735 


Arrow/Schweber Electronics 
20 Oser Avenue 
Hauppauge 11788 

Tel: (516) 231-1000 

FAX: (516) 231-1072 


Avnet Computer 
933 Motor Parkway 
Hauppauge 11788 
Tel: (516) 434-7443 
FAX: (516) 434-7426 


Avnet Computer 
2060 Townline Rd. 
Rochester 14623 
Tel: (716) 272-9110 
FAX: (716) 272-9685 


Hamilton Hallmark 
933 Motor Parkway 
Hauppauge 11788 
Tel: (516) 434-7470 
FAX: (516) 434-7491 


Hamilton Hallmark 
1057 E. Henrietta Road 
Rochester 14623 

Tel: (716) 475-9130 
FAX: (716) 475-9119 


Hamilton Hallmark 

3075 Veterans Memorial Hwy. 
Ronkonkoma 11779 

Tel: (516) 737-0600 

FAX: (516) 737-0838 


MTI Systems 

1 Penn Plaza 

250 W. 34th Street 
New York 10119 
Tel: (212) 643-1280 
FAX: (212) 643-1288 


Pioneer Standard 
68 Corporate Drive 
Binghamton 13904 
Tel: (607) 722-9300 
FAX: (607) 722-9562 


Pioneer Standard 

60 Crossway Park West 
Woodbury, Long Island 11797 
Tel: (516) 921-8700 

FAX: (516) 921-2143 


Pioneer Standard 
840 Fairport Park 
Fairport 14450 

Tel: (716) 381-7070 
FAX: (716) 381-5955 


Zeus Arrow Electronics 
100 Midland Avenue 
Port Chester 10573 
Tel: (914) 937-7400 
FAX: (914) 937-2553 


NORTH CAROLINA 


Arrow/Schweber Electronics 
5240 Greensdairy Road 
Raleigh 27604 

Tel: (919) 876-3132 

FAX: (919) 878-9517 


Avnet Computer 

2725 Millbrook Rd., #123 
Raleigh 27604 

Tel: (919) 790-1735 

FAX: (919) 872-4972 


Hamilton Hallmark 

5234 Greens Dairy Road 
Raleigh 27604 

Tel: (919) 878-0819 
FAX: (919) 878-8729 


NORTH AMERICAN DISTRIBUTORS (Contd.) 


Pioneer Technologies Group 
2200 Gateway Ctr. Blvd, #215 
Morrisville 27560 

Tel: (919) 460-1530 

FAX: (919) 460-1540 


OHIO 


Arrow Commercial Systems Grour 
284 Cramer Creek Court 

Dublin 43017 © 

Tel: (614) 889-9347 

FAX: (614) 889-9680 


Arrow/Schweber Electronics 
6573 Cochran Road, #E 
Solon 44139 

Tel: (216) 248-3990 

FAX: (216) 248-1106 


Arrow/Schweber Electronics 
8200 Washington Village Dr. 
Centerville 45458 

Tel: (513) 435-5563 

FAX: (513) 435-2049 


Avnet Computer 

7764 Washington Village Dr. 
Dayton 45459 

Tel: (613) 439-6756 

FAX: (513) 439-6719 


Avnet Computer 

30325 Bainbridge Rd., Bldg. A 
Solon 44139 

Tel: (216) 349-2505 

FAX: (216) 349-1894 


Hamilton Hallmark 

7760 Washington Village Dr. 
Dayton 45459 

Tel: (513) 439-6735 

FAX: (513) 439-6711 


Hamilton Hallmark 
5821 Harper Road 
Solon 44139 

Tel: (216) 498-1100 
FAX: (216) 248-4803 


Hamilton Hallmark 

777 Dearborn Park Lane, #L 
Worthington 43085 

Tel: (614) 888-3313 

FAX: (614) 888-0767 


MT! Systems 

23404 Commerce Park Rd. 
Beachwood 44122 

Tel: (216) 464-6688 

FAX: (216) 464-3564 


Pioneer Standard 

4433 Interpoint Boulevard 
Dayton 45424 

Tel: (513) 236-9900 

FAX: (513) 236-8133 


Pioneer Standard 
4800 E. 131st Street 
Cleveland 44105 
Tel: (216) 587-3600 
FAX: (216) 663-1004 


OKLAHOMA 


Arrow/Schweber Electronics 
12101 E. 51st Street, #106 
Tulsa 74146 

Tel: (918) 252-7537 

FAX: (918) 254-0917 | 


Hamilton Hallmark 

5411 S. 125th E. Ave., #305 
Tulsa 74146 

Tel: (918) 254-6110 

FAX: (918) 254-6207 


Pioneer Standard 

9717 E. 42nd St., #105 
Tulsa 74146 

Tel: (918) 665-7840 
FAX: (918) 665-1891 


CG/SALE/1112 


EGON 


vac Arrow Electronics 
35 N.W. 169th Place 
averton 97006 

: (503) 629-8090 

X: (503) 645-0611 


them Electronics 

90 S.W. Gemini Drive 
averton 97005 

: (503) 643-1114 

X: (503) 626-7928 


1et Computer 


50 Southwest Nimbus Ave. 


averton 97005 
: (503) 627-0900 
X: (502) 526-6242 


milton Hallmark 

50 S.W. Nimbus Ave. 
averton 97005 

: (503) 526-6200 

X: (503) 641-5939 


le Laboratories 

10 Sunshine Court 
g. G, Suite 200 
averton 97005 

: (503) 643-7900 
X: (503) 646-5466 


NNSYLVANIA 


hem Electronics 

) Business Center Dr. 
rsham 19044 

: (215) 443-5150 

KX: (215) 675-9875 


et Computer 

3 Executive Drive, #320 
rs 16046 

: (412) 772-1888 

X: (412) 772-1890 


neer Technologies Group 
) Kappa Drive 

sburgh 15238 

: (412) 782-2300 

X: (412) 963-8255 


neer Technologies Group 
) Enterprise Road 

th Valley Business Center 
‘sham 19044 

: (713) 530-4700 


le Laboratories 
ves Drive, #111 
rlton 08053-3185 
; (609) 985-7953 
K: (609) 985-8757 


KAS 


hem Electronics 

_N. Plano Road, #401 
hardson 75081 

- (214) 238-7100 

K: (214) 238-0237 


ow/Schweber Electronics 
100 Metric Bivd., #160 
tin 78758 

- (512) 835-4180 

K: (512) 832-5921 


NORTH AMERICAN DISTRIBUTORS (Contd.) 


Arrow/Schweber Electronics 
3220 Commander Dr. 
Carrollton 75006 

Tel: (214) 380-6464 

FAX: (214) 248-7208 


Arrow/Schweber Electronics 
10899 Kinghurst Dr., #100 
Houston 77099 

Tel: (713) 530-4700 


Avnet Computer 

4004 Beltline, Suite 200 
Dallas 75244 

Tel: (214) 308-8181 
FAX: (214) 308-8129 


Avnet Computer 

1235 North Loop West, #525 
Houston 77008 

Tel: (713) 867-8572 

FAX: (713) 861-6851 


Hamilton Hallmark 
12211 Technology Blvd. 
Austin 78727 

Tel: (512) 258-8848 
FAX: (512) 258-3777 


Hamilton Hallmark 
11420 Page Mill Road 
Dallas 75243 

Tel: (214) 553-4300 
FAX: (214) 553-4395 


Hamilton Hallmark 
8000 Westglen 
Houston 77063 

Tel: (713) 781-6100 
FAX: (713) 953-8420 


Pioneer Standard 
1826-D Kramer Lane 
Austin 78758 

Tel: (512) 835-4000 
FAX: (512) 835-9829 


Pioneer Standard 
13765 Beta Road 
Dallas 75244 

Tel: (214) 263-3168 
FAX: (214) 490-6419 


Pioneer Standard 

10530 Rockley Road, #100 
Houston 77099 

Tel: (713) 495-4700 

FAX: (713) 495-5642 


Wyle Laboratories 

1810 Greenville Avenue 
Richardson 75081 

Tel: (214) 235-9953 
FAX: (214) 644-5064 


Wyle Laboratories 

4030 West Braker Lane, #330 
Austin 78758 

Tel: (512) 345-8853 

FAX: (512) 345-9330 


Wyle Laboratories 

11001 South Wilcrest, #100 
Houston 77099 

Tel: (713) 879-9953 

FAX: (713) 879-6540 


UTAH 


Anthem Electronics 
1279 West 2200 South 
Salt Lake City 84119 
Tel: (801) 973-8555 
FAX: (801) 973-8909 


Arrow/Schweber Electronics 
1946 W. Parkway Blvd. 

Salt Lake City 84119 

Tel: (801) 973-6913 

FAX: (801) 972-0200 


Avnet Computer 

1100 E. 6600 South, #150 
Salt Lake City 84121 

Tel: (801) 266-1115 

FAX: (801) 266-0362 


Hamilton Hallmark 

1100 East 6600 South, #120 
Salt Lake City 84121 

Tel: (801) 266-2022 

FAX: (801) 263-0104 


Wyle Laboratories 

1325 West 2200 South, #E 
West Valley 84119 

Tel: (801) 974-9953 

FAX: (801) 972-2524 


WASHINGTON 


Almac Arrow Electronics 
14360 S.E. Eastgate Way 
Bellevue 98007 

Tel: (206) 643-9992 

FAX: (206) 643-9709 


Anthem Electronics 

19017 - 120th Ave., N.E. #102 
Bothell 98011 

Tel: (206) 483-1700 

FAX: (206) 486-0571 


Avnet Computer 
17761 N.E. 78th Place 
Redmond 98052 

Tel: (206) 867-0160 
FAX: (206) 867-0161 


Hamilton Hallmark 
8630 154th Avenue 
Redmond 98052 
Tel: (206) 881-6697 
FAX: (206) 867-0159 


Wyle Laboratories 
15385 N.E. 90th Street 
Redmond 98052 

Tel: (206) 881-1150 
FAX: (206) 881-1567 


WISCONSIN 


Arrow/Schweber Electronics 
200 N. Patrick, #100 
Brookfield 53045 

Tel: (414) 792-0150 

FAX: (414) 792-0156 


Avnet Computer 

20875 Crossroads Circle, #400 
Waukesha 53186 

Tel: (414) 784-8205 

FAX: (414) 784-6006 


Hamilton Hallmark 
2440 S. 179th Street 
New Berlin 53146 
Tel: (414) 797-7844 
FAX: (414) 797-9259 


Pioneer Standard 

120 Bishop Way #163 
Brookfield 53005 

Tel: (414) 784-3480 
FAX: (414) 780-3613 


Wyle Laboratories 

W226 N555 Eastmound Drive 
Waukesha 53186 

Tel: (414) 521-9333 

FAX: (414) 521-9498 


ALASKA 


Avnet Computer ' 
1400 West Benson Bivd., #400 
Anchorage 99503 

Tel: (907) 274-9899 

FAX: (907) 277-2639 


CANADA 


ALBERTA 


Avnet Computer 

2816 21st Street Northeast 
Calgary T2E 6Z2 

Tel: (403) 291-3284 

FAX: (403) 250-1591 


Zentronics 

6815 8th Street N.E., #100 
Calgary T2E 7H 

Tel: (403) 295-8838 

FAX: (403) 295-8714 


BRITISH COLUMBIA 


Almac Arrow Electronics 
8544 Baxter Place 
Burnaby V5A 4T8 

Tel: (604) 421-2333 
FAX: (604) 421-5030 


Hamilton Hallmark 
8610 Commerce Court 
Burnaby V5A 4N6 

Tel: (604) 420-4101 
FAX: (604) 420-5376 


Zentronics 

11400 Bridgeport Rd., #108 
Richmond V6X 1T2 

Tel: (604) 273-5575 

FAX: (604) 273-2413 


ONTARIO 


Arrow/Schweber Electronics 
1093 Meyerside, Unit 2 
Mississauga L5T 1M4 

Tel: (416) 670-7769 

FAX: (416) 670-7781 


Arrow/Schweber Electronics 
36 Antares Dr., Unit 100 
Nepean K2E 7W5 

Tel: (613) 226-6903 

FAX: (613) 723-2018 


Avnet Computer 

Canada System Engineering Group 
151 Superior Bivd. 

Mississuaga L5T 2L1 

Tel: (416) 795-3835 

FAX: (416) 677-5091 


Avnet Computer 

190 Colonade Road 
Nepean K2E 7J5 
Tel: (613) 727-2000 
FAX: (613) 226-1184 


Hamilton Hallmark 

151 Superior Bivd., Unit 1-6 
Mississauga L5T 2L1 

Tel: (416) 564-6060 

FAX: (416) 564-6033 


Hamilton Hallmark 
190 Colonade Road 
Nepean K2E 7J5 
Tel: (613) 226-1700 
FAX: (613) 226-1184 


Zentronics 

5600 Keaton Crescent, #1 
Mississauga L5R 3S5 

Tel: (416) 507-2600 

FAX: (416) 507-2831 


Zentronics 

155 Colonnade Rd., South 
#17 

Nepean K2E 7K1 

Tel: (613) 226-8840 

FAX: (613) 226-6352 


QUEBEC 


Arrow/Schweber Electronics 
1100 St. Regis Blvd. 

Dorval H9P 2T5 

Tel: (514) 421-7411 

FAX: (514) 421-7430 


Arrow/Schweber Electronics 
500 Boul. St.-Jean-Baptiste Ave. 
Quebec H2E 5R9 

Tel: (418) 871-7500 

FAX: (418) 871-6816 


Avnet Computer 
2795 Reu Halpern 
St. Laurent H4S 1P8 
Tel: (514) 335-2483 
FAX: (514) 335-2481 


Hamilton Hallmark 

7575 Transcanada Highway 
#600 

St. Laurent H4T 2V6 

Tel: (514) 335-1000 

FAX: (514) 335-2481 


Zentronics 

520 McCaffrey 

St. Laurent H4T 1N3 
Tel: (514) 737-9700 

FAX: (514) 737-5212 


CG/SALE/111293 


intel. 


FINLAND 


Intel Finland OY 
Ruosilantie 2 

00390 Helsinki 

Tel: (358) 0 544 644 
FAX: (358) 0 544 030 


FRANCE 


Intel Corporation S.A.R.L. 
1, Rue Edison-BP 303 
78054 St. Quentin-en-Yvelines 


Cedex 
Tel: (33) (1) 30 57 70 00 
FAX: (33) (1) 30 64 60 32 


EUROPEAN SALES OFFICES 


GERMANY 


Intel GmbH 

Dornacher Strasse 1 

85622 Feldkirchen/Muenchen 
Tel: (49) 089/90992-0 

FAX: (49) 089/9043948 


ISRAEL 
Intel Semiconductor Ltd. 


Atidim Industrial Park-Neve Sharet 


P.O. Box 43202 
Tel-Aviv 61430 

Tel: (972) 03 498080 
FAX: (972) 03 491870 


ITALY 


Intel Corporation Italia S.p.A. 
Milanofiori Palazzo E 

20094 Assago 

Milano 

Tel: (39) (2) 575441 

FAX: (39) (2) 3498464 


NETHERLANDS 


Intel Semiconductor B.V. 
Postbus 84130 

3009 CC Rotterdam 

Tel: (31) 10 407 1111 . 
FAX: (31) 10 455 4688 


RUSSIA 


Intel pest i Inc. 
Krementshugskaya 6/7 
121357 Moscow 

Tel: 007-095-4439785 

FAX: 007-095-4459420 
TLX: 612092 smail su. 


SPAIN 


Intel Iberia S.A. 
Zubaran, 28 

28010 Madrid 

Tel: (34) (1) 308 2552 
FAX: (34) (1) 410 7570 


SWEDEN 


Intel Sweden A.B. 
Dalvagen 24 

171 36 Solna 

Tel: (46) 8 705 5600 
FAX: (46) 8 278085 


UNITED KINGDOM 


Intel Corporation (U.K.) Ltd. 
Pipers Way 

Swindon, Wiltshire SN3 1RJ 
Tel: (44) (0793) 696000 
FAX: (44) (0793) 641440 


EUROPEAN DISTRIBUTORS/REPRESENTATIVES 


AUSTRIA 


t*Elbatex GmbH 
Eitnergasse 6 
A-1231 Wien 

Tel: (43) 1816020 
FAX: (43) 181652141 


tSpoerle Electronic 
Heiligenst. Str. 62 
A-1190 Wien 

Tel: (43) 1 318 72 700 
FAX: (43) 1 369 22 73 


BELGIUM 


t*Inelco Distribution 

Avenue des Croix de Guerre 94 
1120 Bruxelles 

Tel: (32) 2 244 2811 

FAX: (32) 2 216 3304 


*Diode Belgium 

Keiberg II, Minervastraat, 14/B2 
1930 Zaventem 

Tel: (32) 2 725 46 60 

FAX: (32) 2 725 45 11 


DENMARK 


*Avnet Nortec A/S 
Transformervej 17 
DK-2730 Herlev 

Tel: (45) 4284 2000 
FAX: (45) 4492 1552 


t*ITT Multikomponent AS 
Naverland 29 

DK-2600 Glostrup 

Tel: (45) 4245 6645 

FAX: (45) 4245 7624 


FINLAND 


t*OY Fintronic AB 
Pyyntitie, 3 

02230 Espoo 

Tel: (358) 0 887 331 
FAX: (358) 0 887 33 343 


FRANCE 


*Arrow Electronique 
73-79 Rue des Solets 
Silic 585 

94663 Rungis Cedex 
Tel: (33) (1) 4978 4978 
FAX: (33) (1) 4978 0596 


*Avnet 

79, rue Pierre Semard 
92322 Chatillon 

Tel: (33) (1) 4965 2500 
FAX: (33) (1) 4965 2769 


tMetrologie 

Tour d’Asnieres 

4, Avenue Laurent Cely 
92606 Asnieres Cedex 

Tel: (33) (1) 4080 9000 
FAX: (33) (1) 4791 0561 


*Tekelec 

Cite des Bruyeres 

5, Rue Carle Vernet-BP 2 
92310 Sevres 

Tel: (33) (1) 4623 2425 
FAX: (33) (1) 4507 2191 


*Components 
tSystems 


GERMANY 


*Avnet Electronic 2000 
Stahigruberring 12 
81829 Muenchen 

Tel: (49) 89 45110-01 
FAX: (49) 89 45110129 


*Jermyn GmbH 

im Dachsstueck 9 
65549 Limburg 

Tel: (49) 6431 5080 
FAX: (49) 6431 508289 


tMetrologie GmbH 
Steinerstrasse 15 
81369 Muenchen 

Tel: (49) 89 724470 
FAX: (49) 89 72447111 


*Proelectron Vertriebs GmbH 
Max-Planck-Strasse 1-3 
63303 Dreieich 

Tel: (49) 6103 304343 

FAX: (49) 6103 304425 


tRein Elektronik GmbH 
Loetscher Weg 66 
41303 Nettetal 

Tel: (49) 2153 7330 
FAX: (49) 2153 733513 


GREECE 


tErgodata 
Aigiroupoleos 2A 

176 76 Kalithea 

Tel: (30) 1 95 10 922 
FAX: (30) 1 95 93 160 


*Pouliadis Associates Corp. 
Aristotelous St. 3/Sygrou Av. 150 
Athens 17671 

Tel: (30) 1 924 2072 

FAX: (30) 1 924 1066 . 


IRELAND 


t*Micro Marketing 
Taney Hall 

Eglinton Terrace 
Dundrum 

Dublin 14 

Tel: (353) (1) 298 9400 
FAX: (353) (1) 298 9828 


ISRAEL 


t*Eastronics Limited 
Rozanis 11 

P.O.B. 39300 

Tel Baruch 

Tel-Aviv 61392 

Tel: (972) 3 6458 777 
FAX: (972) 3 6458 666 


ITALY 


*Intesi Div. Della Deutsche 
Divisione ITT Industries GmbH 
P.1. 06550110156 

Milanofiori Palazzo e5 

20094 Assago (Milano) 

Tel: (39) 2 824701 

FAX: (39) 2 8242631 


*Lasi Elettronica 

P.1. 00839000155 

Viale Fulvio Testi, N.280 
20126 Milano 

Tel: (39) 2 661431 

FAX: (39) 2 66101385 


tOmnilogic Telcom 
Via Lorenteggio 270/A 
20152 Milano 

Tel: (39) 2 48302640 
FAX: (39) 2 43802010 


NETHERLANDS 


tDatelcom B.V. 
Meidoornkade 22 
3993 AE Houten 

Tel: (31) 3403 57222 
FAX: (31) 3403 57220 


*Diode Components 
Coltbaan 17 

3439 NG Nieuwegein 
Tel: (31) 3402 9 12 34 
FAX: (31) 3402 3 59 24 


t*Koning en Hartman 
Energieweg 1 

2627 AP Delft 

Tel: (31) 15 609 906 
FAX: (31) 15 619 194 


NORWAY 


*Avnet Nortec A/S 
Postboks 123 
N-1364 Hvalstad 
Tel: (47) 284 6210 
FAX: (47) 284 6545 


tComputer System Integration A/S 
Postbox 198 

N-2013 Skjetten 

Tel: (47) 638 45 411 

FAX: (47) 638 45 310 


PORTUGAL 


*ATD Electronica LDA 
Edificio Altejo 

Rua 3 piso 5-sala 505 
Urbanizacao de Matinha 
1900 Lisboa 

Tel: (351) (1) 858 0191 /2 
FAX: (351) (1) 858 7841 


tMetrologia Iberica Portugal 

Rua Dr. Faria de Vasconcelos 3A 
1900 Lisboa 

Tel: (351) (1) 847 2202 

FAX: (351) (1) 847 2197 


SOUTH AFRICA 


t*EBE 

PO Box 912-1222 
Silverton 0127 

178 Erasmus Street 
Meyerspark 

Pretoria 0184 

Tel: (27) 12 803 7680-93 
FAX: (27) 12 803 8294 


SPAIN 


*ATD Electronica 

Avenue de la Industria, 32, 2B 
28100 Alcobendas 

Madrid 

Tel: (34) (1) 661 6551 

FAX: (34) (1) 661 6300 


tMetrologia Iberica 
Avda. Industria, 32-2 
28100 Alcobendas 
Madrid 

Tel: (34) (1) 661 1142 
FAX: (34) (1) 661 5755 


SWEDEN 


tAvnet Computer AB 
Box 184 

S-123 23 Farsta 

Tel: (46) 8 705 18 00 
FAX: (46) 8 735 2373 


*Avnet Nortec AB 
Box 1830 

S-171 27 Solna 
Tel: (46) 8705 1800 
FAX: (46) 883 6918 


*ITT Multikomponent AB 
Ankdammsgatan 32 

Box 1330 

S-171 26 Soina 

Tel: (46) 8 830020 

FAX: (46) 8 27 13 03 


SWITZERLAND 


tElbatex AG 

Hardstr. 7 

CH-5430 Wettingen 
Tel: (41) 56 27 50 00 
FAX: (41) 27 19 24 


tFabrimex AG 
Kirchenweg 5 
CH-8032 Zurich 

Tel: (41) 1 386 86 86 
FAX: (41) 1 383 23 79 


tIMIC Microcomputer 
Zurichstrasse 
CH-8185 Winkel-Ruti 
Tel: (41) (1) 8620055 
FAX: (41) (1) 8620266 


t*industrade AG 
Hertistrasse 31 
CH-8304 Walliselien 
Tel: (41) (1) 8328111 
FAX: (41) (1) 8307550 


TURKEY 


*Empa Electronic 
Florya Is Merkezi 
Besyol Londra Asfalti 
34630 Florya Istanbul 
Tel: (90) (1) 599 3050 
FAX: (90) (1) 599 3061 


UNITED KINGDOM 


*Arrow Electronics 

St. Martins Business Centre 
Cambridge Road 

Bedford - MK42 OLF 

Tel: (44) 234 270272 

FAX: (44) 234 211434 


*Avnet EMG Ltd. 

Jubilee House 

Jubilee Road 

Letchworth 

Hertsfordshire - SG6 1QH 
Tel: (44) 462 488 500 
FAX: (44) 462 488 567 


*Bytech Components 
12a Cedarwood 
Chineham Business Park 
4 Crockford Lane 
Basingstoke 

Hants RG12 1RW 

Tel: (44) 256 707 107 
FAX: (44) 256 707 162 


tBytech Systems 

5 The Sterling Centre 
Eastern Roa 

Bracknell 

Berks - RG12 2PW 
Tel: (44) 344 55 333 
FAX: (44) 344 867 270 


*Datrontech 

42-44 Birchett Road 
Aldershot 

Hants —GU11 1LU 
Tel: (44) 252 313155 
FAX: (44) 252 341939 


*Jermyn Electronics 
Vestry Estate 

Otford Road 
Sevenoaks 

Kent TN14 5EU 

Tel: (44) 732 743 743 
FAX: (44) 732 451 251 


tMetrologie VA 

Rapid House 

Oxford Road 

High Wycombe 

Bucks - HP11 2E 

Tel: (44) 494 526 271 
FAX: (44) 494 421 860 


*MMD/Rapid Ltd. 
Rapid Silicon 

3 Bennet Court 
Bennet Road 

Readin 

Berks - RG2 0QX 

Tel: (44) 734 750 697 
FAX: (44) 734 313 255 
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STRALIA 
>! Australia Pty. Ltd. 
it 13 


ambie Grove Business Park 
Frenchs Forest Road East 
inchs Forest, NSW, 2086 


Iney 
: 61-2-975-3300 
X: 61-2-975-3375 


21 Australia Pty. Ltd. 
| High Street 

Floor 

st Kw. Vic., 3102 
lbourne 

: 61-3-810-2141 

X: 61-3-819 7200 


AZIL 


21 Semicondutores do Brasil 
a Florida, 1703-2 and CJ.22 
P 04565-001 Sao Paulo 
Brazil 

: 55-11-530-2296 

K: §5-11-531-5765 


INA/HONG KONG 


1 PRC Corporation 

om 517-518 

na World Tower 

ian Guo Men Wai Avenue 
jing 100004 

yublic of China 

- 861-505-0386 

X: 861-505-0383 


INTERNATIONAL SALES OFFICES 


Intel Semiconductor Ltd.* 
32/F Two Pacific Place 
88 Queensway 

Central 

Hong Kon 

Tel: (852) 844-4555 

FAX: (852) 868-1989 


INDIA 


Intel Asia Electronics, Inc. 
4/2, Samrah Plaza 

St. Mark’s Road 

Bangalore 560001 

Tel: 91-80-215065 

FAX: 91-80-215067 

TLX: 953-845-2646 INTL IN 


JAPAN 


Intel Japan K.K. 

5-6 Tokodai, Tsukuba-shi 
Ibaraki, 300-26 

Tel: 0298-47-8511 

FAX: 0298-47-8450 


Intel Japan K.K.* 
Hachioji ON Bidg. 
4-7-14 Myojin-machi 
Hachioji-shi, Tokyo 192 
Tel: 0426-48-8770 
FAX: 0426-48-8775 


Intel Japan K.K.* 
Kawa-asa Bldg. 

2-11-5 Shin-Yokohama 
Kohoku-ku, Yokohama-shi 
Kanagawa, 222 

Tel: 045-474-7660 

FAX: 045-471-4394 


Intel Japan K.K.* 
Ryokuchi-Eki Bldg. 

2-4-1 Terauchi 
Toyonaka-shi, Osaka 560 
Tel: 06-863-1091 

FAX: 06-863-1084 


Intel Japan K.K. 
Shinmaru Bldg. 

1-5-1 Marunouchi 
Chiyoda-ku, Tokyo 100 
Tel: 03-3201-3621 
FAX: 03-3201-6850 


Intel Japan K.K.* 

TK Gotanda Bidg. 9F 
8-3-6 Nishi Gotanda 
Shinagawa, Tokyo 141 
Tel: 03-3493-6081 
FAX: 03-3493-5951 


KOREA 


Intel Korea, Ltd. 

16th Floor, Life Bidg. 

61 Yoido-dong, Youngdeungpo-Ku 
Seoul 150-010 

Tel: (2) 784-8186 

FAX: (2) 784-8096 


MEXICO 


Intel Tecnologia de Mexico 
S.A. de C.V. 

Av. Mexico No. 2798-9B, S.H. 
44680 Guadalajara, Jal. 

Tel: 011-523-640-1259 

FAX: 011-523-642-7661 


SINGAPORE 


Intel Singapore Technology, Ltd. 
101 Thomson Road #08-05  _— 
United Square 

Singapore 1130 

Tel: (65) 250-7811 

FAX: (65) 250-9256 


TAIWAN 


Intel Technology Far East Ltd. 

Taiwan Branch 

8th Floor, No. 205 

Bank Tower Bidg. 

Tung Hua N. Road 

Taipei 

Tel: 886-2-5144200 

FAX: 886-2-717-2455 
886-2-719-6184 


INTERNATIONAL DISTRIBUTORS/REPRESENTATIVES 


GENTINA 


sys Consulting S.A. 
acabuco, 90-6 Piso 
9-Buenos Aires 

_& FAX: 54.1334.1871 


STRALIA 


> Electronics Australia 
37 Ricketts Road 

unt Waverley, VIC 3149 
- 61-3-558-9868 

: 61-3-558-9929 


D-Australia 

} Middleborough Rd. 
C Hill, Victoria 3128 

- 03 8900970 

«: 03 8990819 


AZIL 


ch 

s Carlos Berrini, 801 CJ121 
171, Sao Paulo, SP Brazil 

- 5511-536-0355 

(: 5511-240-2650 


rolinear 

inida Wilhelm Winter, 345 
trito Industrial - Jundiai, SP 
13-000 

| §511-732-6111 

«: 5511-732-2892 


ILE 


{eco 

inal 40 —Las Condes 
itiago 

| 562-234-1644 

(: 562-233-9895 


INA/HONG KONG 


e| Precision Machinery Co., Ltd. 


ym 728 Trade Square 
Cheung Sha Wan Road 

vioon, Hong Kong 

| (852) 360-8999 

X: 32032 NVTNL HX 

(: (852) 725-3695 


aid Application Location 


GUATEMALA 


Abinitio 

11 Calle 2—Zona 9 
Guatemala City 
Tel: 5022-32-4104 
FAX: 5022-32-4123 


INDIA 


Priya International Limited 

D-6, Il Floor 

Devatha Plaza 

131/132 Residency Rd. 
Bangalore ‘560 025 

Tel: 91-80-214027, 91-80-214395 
FAX: 91-80-214105 


Priya International Limited 

Apeejay House, 4th Floor 

130 Apollo Street 

Bombay 400 023 

Tel: 91-22-2660949, 91-22-2665822 


Priya International Limited 

Flat No. 8, 10th Floor 

Akashdeep Building 

Barakhamba Rd. 

New Delhi 110 001 

Tel: 91-11-3314512, 91-11-3310413 
FAX: 91-11-3719107 


Priya International Limited 

5-J, Century Plaza 

560-562 Mount Road, Teynampet 
Madras 600 018 

Tel: 91-44-451031, 91-44-451597 
FAX: 91-44-813549 


Priya International Limited 

No. 10, Il Floor, Minerva House 

94 Sarojini Devi Rd. 

Secunderabad 500 003 

Tel: 91-842-813120, 91-842-813549 


Priya International Limited 

Lords, Ill Floor 

7/1 Lord Sinha Road 

Calcutta 700 071 

Tel: 91-33-222378, 91-33-222379 
FAX: 91-33-224884 


SES Computers & Technologies 
Pvt. Ltd. 


11/18, SNS Chambers 

239 Palace Upper Orchards 
Sankey Road, Sadashivanagar 
Bangalore 560 080 

Tel: 91-812-348481 

FAX: 91-812-343685 


SES Computers & Technologies 
Pvt. Ltd. 


Arvind Chambers 

194, Andheri-Kurla Road 

Andheri (East) 

Bombay 400 069 

Tel: 91-22-6341584, 91-22-6341667 
FAX: 91-22-4937524 


SES Computers & Technologies 
Pvt. Ltd. 

605-A, Ansal Chambers II 

No. 6, Bhikaji Camaplace 

New Delhi 110 066 

Tel: 91-11-6881663 

FAX: 91-11-6840471 


JAMAICA 


MC Systems 

10-12 Grenada Crescent 
Kingston 5 

Tel: (809) 926-0104 
FAX: (809) 929-5678 


JAPAN 


Asahi Electronics Co. Ltd. 
KMM Bldg. 2-14-1 Asano 
Kokurakita-ku 
Kitakyushu-shi 802 

Tel: 093-511-6471 

FAX: 093-551-7861 


Dia Semicon Systems, Inc. 
Flower Hill Shinmachi Higashi-kan 
1-23 Shinmachi, Setagaya-ku 
Tokyo 154 

Tel: 03-3439-1600 

FAX: 03-3439-1601 


Okaya Koki 

2-4-18 Sakae 

Naka-ku, Nagoya-shi 460 
Tel: 052-204-8315 

FAX: 052-204-8380 


Ryoyo Electro Corp. 
Konwa Bidg. 
1-12-22 Tsukiji 
Chuo-ku, Tokyo 104 
Tel: 03-3546-501 1 
FAX: 03-3546-5044 


KOREA 


Samsung Electronics 

Samsung Main Bldg. 

150 Taepyung-Ro-2KA, Chung-Ku 
Seoul 100-102 

C.P.0. Box 8780 

Tel: (822) 751-3680 

TWX: KORSST K 27970 

FAX: (822) 753-9065 


Tong Baek Electronic Co., Ltd. 
16-58 Hangang-ro 3-ga 
Yongsan-gu, Seoul 

Tel: 82-2-715-6623 

FAX: 82-2-715-9374 


SAUDI ARABIA 


AAE Systems, Inc. 
642 N. Pastoria Ave. 
Sunnyvale, CA 94086 
U.S.A 


Tel: (408) 732-1710 
FAX: (408) 732-3095 
TLX: 494-3405 AAE SYS 


SINGAPORE 


Electronic Resources Pte, Ltd. 
17 Harvey Road 

#03-01 Singapore 1336 

Tel: (65) 283-0888 

TWX: RS 56541 ERS 

FAX: (65) 289-5327 


SOUTH AFRICA 


Electronic Building Elements 
178 Erasmus St. 

(off Watermeyet St.) 
Meyerspark, Pretoria, 0184 
Tel: 011-2712-803-7680 
FAX: 011-2712-803-8294 


TAIWAN 


Micro Electronics Corporation 
12th Floor, Section 3 

285 Nanking East Road \ 
Taipei, R.O.C. 

Tel: (886) 2-7198419 

FAX: (886) 2-7197916 


Acer Sertek Inc. 

15th Floor, Section 2 
Chien Kuo North Rd. 
Taipei 18479 R.O.C. 
Tel: 886-2-501-0055 
TWX: 23756 SERTEK 
FAX: (886) 2-5012521 


URUGUAY 


Interfase 

Bivr. Espana 2094 

11200 Montevideo 
Tel: 5982-49-4600 

FAX: 5982-49-3040 


VENEZUELA 


Unixel C.A. 

4 Transversal de Monte Cristo 
Edf. AXXA, Piso 1, of. 1&2 
Centro Empresarial Boleita 
Caracas 

Tel: 582-238-7749 

FAX: 582-238-1816 
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ALABAMA 


Birmingham 
Huntsville 


ALASKA 
Anchorage 


ARIZONA 


Phoenix* 
Tucson 


ARKANSAS 
Little Rock 


CALIFORNIA 


Bakersfield 
Brea 

Carson* 
Fresno 
Livermore 

Mar Del Rey 
Ontario* 
Orange 
Sacramento* 
San Diego* 
San Francisco* 
Santa Clara* 
Ventura 
Sunnyvale 
Wainut Creek* 
Woodland Hills* 


COLORADO 


Colorado Springs 
Denver 
Englewood* 


CONNECTICUT 
Glastonbury* 


DELAWARE 
New Castle 


FLORIDA 


Ft. Lauderdale 
Heathrow 
Jacksonville 
Melbourne 
Pensacola 
Tampa 

West Palm Beach 


ARIZONA 


Computervision Customer 
Education 

2401 W. Behrend Dr., Suite 17 
Phoenix 85027 

Tel: 1-800-234-8806 


MINNESOTA 


3500 W. 80th Street 
Suite 360 

Bloomington 55431 
Tel: (612) 835-6722 


*Carry-in locations 


NORTH AMERICAN SERVICE OFFICES 


COMPUTERVISION 


Intel Corporation’s North American Preferred Service Provider 
Central Dispatch: 1-800-876-SERV (1-800-876-7378) 


GEORGIA MICHIGAN NORTH DAKOTA VIRGINIA 
Atlanta* Ann Harbor Bismark : 
Savannah Benton Harbor Charlottesville 
West Robbins Flint OHIO Glen Allen 

Grand Rapids* ee Maclean 
Leslie Cincinnati* Norfolk 
HAWAII Livonia* alia Virginia Beach 
St. Joseph ayton 
Honolulu Troy" p in dep ndence” 
la WASHINGTON 
ILLINOIS MINNESOTA Toledo* 
Buffalo* : 
é Bloomington* OREGON Bellevue* 
Calumer City Deluth at Olympia 
foe Beaverton* Renton 
MISSOURI Richland 
Oak Brook PENNSYLVANIA Spokane 
Springfield . Verdale 
INDIANA St. Louis* Bala Cynwyd 
a ill* 
Carmel* East Erie 
Ft. Wayne sti til Pittsburgh* WASHINGTON D.C.* 
Minden Wayne* 
Las Vegas 
KANSAS 
See _— SOUTH CAROLINA WEST VIRGINIA 
¥ Abi Charleston 
Wichita NEW HAMSHIRE Cherry Point x Seas 
Manchester* Columbia 
KENTUCKY Fountain Inn 
‘ NEW JERSEY 
Lexington WISCONSIN 
Louisville Edison* SOUTH DAKOTA 
Madisonville Hamton Town* Sioux Falls Brookfield* 
Parsippany* Green Bay 
LOUISIANA sary shaleinatias TENNESSEE Macioon 
ausa 
Baton Rouge Bartlett ae 
Metarie Albuquerque Chattanooga 
Knoxville 
MAINE NEW YORK Nashville CANADA 
Brunswick soem TEXAS Calgary" 
Dewitt* Austin monton 
MARYLAND Fairport* Bay City poe 
fae e Farmingdale* Beaumont rs 
Frederick New York City* Canyon Montreal 
Linthicum * College Station givens fi 
Heats NORTH CAROLINA aa Vancouver, BC* 
MASSACHUSETTS Brevard San Antonio waeen 
Charlotte Tyler Sg te 
Boston* Greensboro t. John 
atic aveluc 
Norton* Raleigh via 
Springfield Wilmington Salt Lake City* 
ILLINOIS MASSACHUSETTS 
ij Computervision Customer 

rth sa Customer Education 

1 Oakbrook Terrace 11 Oak Park Drive 

Suite 600 Bedford 01730 

Oakbrook 60181 Tel: 1-800-234-8806 


Tel: 1-800-234-8806 


SYSTEMS ENGINEERING OFFICES 


NEW YORK 


2950 Expressway Dr., South 
Islandia 11722 
Tel: (506) 231-3300 
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Flash Memory: Volume I 


In today’s vast array of semiconductor memory choices, the design 
engineer’s job is to match memory characteristics to the application. 
Since 1971, Intel has offered a variety of memory devices to suit a 
wide range of applications. The most compelling of these is flash 
memory — a technology which Intel has remained the market-share 


leader for over six years. 


Because of their inherent features, Intel’s Flash Memory products 
are dramatically altering traditional computer memory solutions. 
Today’s hand-held palmtop computers, personal organizers and 
notebook PCs need a solid-state storage technology that provides the 
optimum combination of performance, size, weight, low power and 
shock resistance demanded by today’s mobile computer user. As a 
high density, non-volatile, read/write semiconductor technology, Intel 
Flash Memory is the ideal memory medium to meet these seemingly 
competing requirements whether implemented in memory cards, 
solid-state disks or components. 


This handbook is devoted to techniques and information to help. 
design semiconductor memory into an application or system... - 
Informative data sheets provide many comprehensive charts, 
block diagrams, operating characteristics and programming 
modes. Application notes provide diagrams and hardware design 


information; relevant article reprints are also included. ~- 
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